From 81218a833c3c2a2f4db99489eb09843d8b203167 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=A9rome=20Maes?= <jem@openerp.com>
Date: Mon, 16 Oct 2017 16:17:01 +0200
Subject: [PATCH] [FIX] sale_timesheet: access right when validate invoice

When validate an invoice, if you are timesheet
user and billing user, it is forbidden for you
to create an analytic line without a project set.
This commit allow billing user to create AAL.

opw-776391
---
 addons/sale_timesheet/__manifest__.py         |  1 +
 .../security/sale_timesheet_security.xml      | 19 +++++++++++++++++++
 2 files changed, 20 insertions(+)
 create mode 100644 addons/sale_timesheet/security/sale_timesheet_security.xml

diff --git a/addons/sale_timesheet/__manifest__.py b/addons/sale_timesheet/__manifest__.py
index e65f7580af7..0cb9db63bae 100644
--- a/addons/sale_timesheet/__manifest__.py
+++ b/addons/sale_timesheet/__manifest__.py
@@ -16,6 +16,7 @@ have real delivered quantities in sales orders.
     'website': 'https://www.odoo.com/page/warehouse',
     'depends': ['sale_management', 'hr_timesheet'],
     'data': [
+        'security/sale_timesheet_security.xml',
         'views/account_invoice_views.xml',
         'views/sale_order_views.xml',
         'views/product_views.xml',
diff --git a/addons/sale_timesheet/security/sale_timesheet_security.xml b/addons/sale_timesheet/security/sale_timesheet_security.xml
new file mode 100644
index 00000000000..f038e964ad8
--- /dev/null
+++ b/addons/sale_timesheet/security/sale_timesheet_security.xml
@@ -0,0 +1,19 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<odoo>
+
+    <data noupdate="1">
+
+        <record id="account_analytic_line_rule_billing_user" model="ir.rule">
+            <field name="name">account.analytic.line.billing.user</field>
+            <field name="model_id" ref="analytic.model_account_analytic_line"/>
+            <field name="domain_force">[('project_id', '=', False)]</field>
+            <field name="groups" eval="[(4, ref('account.group_account_invoice'))]"/>
+            <field name="perm_create" eval="1"/>
+            <field name="perm_write" eval="1"/>
+            <field name="perm_unlink" eval="1"/>
+            <field name="perm_read" eval="0"/>
+        </record>
+
+    </data>
+
+</odoo>