From 81d1296323fdaeb88c37bde45f7443afd6ebd0ac Mon Sep 17 00:00:00 2001
From: Nicolas Martinelli <nim@odoo.com>
Date: Fri, 5 Jan 2018 13:55:10 +0100
Subject: [PATCH] [FIX] account, stock, website: access rights

1. Create a new user with all the permissions as manager (or at least
   Accounting) except Inventory
2. Login and then go to Invoicing --> Settings
3. Do a minor change, save

An access error occurs.

Since the settings of all modules are smartly loaded in v11, it now
implies that a user must have extra manager access rights to be allowed
to save them. We could have kept separate actions for each setting page,
but we would have missed the fun of access errors.

Anyway, security-wise this is not an issue to force the manager groups
since a user with 'Settings' access rights can change his own rights.
It's just very annoying. Or fun.

Complement of aa65a46fc50701f

Fixes #21766
opw-801210
---
 addons/account/security/account_security.xml | 4 ++++
 addons/stock/models/res_config_settings.py   | 2 ++
 addons/website/security/website_security.xml | 4 ++++
 3 files changed, 10 insertions(+)

diff --git a/addons/account/security/account_security.xml b/addons/account/security/account_security.xml
index dabb7946440..c527729765c 100644
--- a/addons/account/security/account_security.xml
+++ b/addons/account/security/account_security.xml
@@ -23,6 +23,10 @@
         <field name="groups_id" eval="[(4, ref('account.group_account_invoice')), (4, ref('account.group_account_manager'))]"/>
     </record>
 
+    <record id="base.group_system" model="res.groups">
+        <field name="implied_ids" eval="[(4, ref('account.group_account_manager'))]"/>
+    </record>
+
     <record id="group_warning_account" model="res.groups">
         <field name="name">A warning can be set on a partner (Account)</field>
         <field name="category_id" ref="base.module_category_hidden"/>
diff --git a/addons/stock/models/res_config_settings.py b/addons/stock/models/res_config_settings.py
index 79adb8fb349..18de1464119 100644
--- a/addons/stock/models/res_config_settings.py
+++ b/addons/stock/models/res_config_settings.py
@@ -72,6 +72,8 @@ class ResConfigSettings(models.TransientModel):
     @api.multi
     def set_values(self):
         super(ResConfigSettings, self).set_values()
+        if not self.user_has_groups('stock.group_stock_manager'):
+            return
         self.env['ir.config_parameter'].sudo().set_param('stock.use_propagation_minimum_delta', self.use_propagation_minimum_delta)
         """ If we are not in multiple locations, we can deactivate the internal
         operation types of the warehouses, so they won't appear in the dashboard.
diff --git a/addons/website/security/website_security.xml b/addons/website/security/website_security.xml
index 99264d4e460..6702d0878f1 100644
--- a/addons/website/security/website_security.xml
+++ b/addons/website/security/website_security.xml
@@ -15,6 +15,10 @@
         <field name="groups_id" eval="[(4, ref('group_website_designer'))]"/>
     </record>
 
+    <record id="base.group_system" model="res.groups">
+        <field name="implied_ids" eval="[(4, ref('website.group_website_designer'))]"/>
+    </record>
+
     <record id="website_designer_edit_qweb" model="ir.rule">
         <field name="name">website_designer: Manage Website and qWeb view</field>
         <field name="model_id" ref="base.model_ir_ui_view"/>