From 82b992fb899c856d75334279fbdcea4831f84690 Mon Sep 17 00:00:00 2001 From: "Xavier BOL (xbo)" Date: Thu, 14 Apr 2022 13:18:32 +0000 Subject: [PATCH] [FW][FIX] project: remove uneccessary read access for portal user Before this commit, the portal user can read the `project.update` and `project.milestone` records but there is no reason to grant this access for those models. This commit removes the read access for thoses models since we don't show the data in its portal. X-original-commit: f0331531826974ddaab5dff28739115c37a351c0 Forward-port-of: #88546 Forward-port-of: #88509 Part-of: odoo/odoo#88819 --- addons/project/security/ir.model.access.csv | 4 +- .../test_project_update_access_rights.py | 52 +++++++++++++++++++ 2 files changed, 54 insertions(+), 2 deletions(-) diff --git a/addons/project/security/ir.model.access.csv b/addons/project/security/ir.model.access.csv index 38032cf4c6b..c4794bbbada 100644 --- a/addons/project/security/ir.model.access.csv +++ b/addons/project/security/ir.model.access.csv @@ -31,11 +31,11 @@ access_project_task_recurrence,project.task.recurrence,model_project_task_recurr project.access_project_task_burndown_chart_report,access_project_task_burndown_chart_report,project.model_project_task_burndown_chart_report,project.group_project_manager,1,1,1,1 project.access_project_task_burndown_chart_report_user,access_project_task_burndown_chart_report_user,project.model_project_task_burndown_chart_report,project.group_project_user,1,0,0,0 access_project_update_user,project.update.user,model_project_update,base.group_user,1,0,0,0 -access_project_update_portal,project.update.portal,model_project_update,base.group_portal,1,0,0,0 +access_project_update_portal,project.update.portal,model_project_update,base.group_portal,0,0,0,0 access_project_update_project_user,project.update.project.user,model_project_update,project.group_project_user,1,1,1,1 access_project_update_project_manager,project.update.project.manager,model_project_update,project.group_project_manager,1,1,1,1 access_project_milestone_user,project.milestone.user,model_project_milestone,base.group_user,1,0,0,0 -access_project_milestone_portal,project.milestone.portal,model_project_milestone,base.group_portal,1,0,0,0 +access_project_milestone_portal,project.milestone.portal,model_project_milestone,base.group_portal,0,0,0,0 access_project_milestone_project_user,project.milestone.project.user,model_project_milestone,project.group_project_user,1,1,1,1 access_project_milestone_project_manager,project.milestone.project.manager,model_project_milestone,project.group_project_manager,1,1,1,1 access_project_collaborator_manager,project.collaborator.manager,model_project_collaborator,project.group_project_manager,1,1,1,1 diff --git a/addons/project/tests/test_project_update_access_rights.py b/addons/project/tests/test_project_update_access_rights.py index 747ea83c3ab..986bd3abc30 100644 --- a/addons/project/tests/test_project_update_access_rights.py +++ b/addons/project/tests/test_project_update_access_rights.py @@ -17,9 +17,14 @@ class TestProjectUpdateAccessRights(TestProjectCommon): 'project_id': cls.project_pigs.id, 'status': 'on_track', }) + cls.project_milestone = cls.env['project.milestone'].create({ + 'name': 'Test Projec Milestone', + 'project_id': cls.project_pigs.id, + }) cls.base_user = mail_new_test_user(cls.env, 'Base user', groups='base.group_user') cls.project_user = mail_new_test_user(cls.env, 'Project user', groups='project.group_project_user') cls.project_manager = mail_new_test_user(cls.env, 'Project admin', groups='project.group_project_manager') + cls.portal_user = mail_new_test_user(cls.env, 'Portal user', groups='base.group_portal') @users('Project user', 'Project admin', 'Base user') def test_project_update_user_can_read(self): @@ -42,3 +47,50 @@ class TestProjectUpdateAccessRights(TestProjectCommon): @users('Project admin') def test_project_update_admin_unlink(self): self.project_update_1.with_user(self.env.user).unlink() + + @users('Portal user') + def test_project_update_portal_user_no_read(self): + with self.assertRaises(AccessError, msg=f"{self.env.user.name} should not be able to read in the project update"): + self.project_update_1.with_user(self.env.user).name + + @users('Portal user') + def test_project_update_portal_user_no_write(self): + with self.assertRaises(AccessError, msg=f"{self.env.user.name} should not be able to write in the project update"): + self.project_update_1.with_user(self.env.user).name = 'Test write' + + @users('Portal user') + def test_project_update_portal_user_no_create(self): + with self.assertRaises(AccessError, msg=f"{self.env.user.name} should not be able to create in the project update model"): + self.env['project.update'].with_user(self.env.user).create({ + 'name': 'Test Create with portal user', + 'project_id': self.project_pigs.id, + 'state': 'on_track', + }) + + @users('Portal user') + def test_project_update_portal_user_no_unlink(self): + with self.assertRaises(AccessError, msg=f"{self.env.user.name} should not be able to unlink in the project update"): + self.project_update_1.with_user(self.env.user).unlink() + + @users('Portal user') + def test_project_milestone_portal_user_no_read(self): + with self.assertRaises(AccessError, msg=f"{self.env.user.name} should not be able to read in the project update"): + self.project_milestone.with_user(self.env.user).name + + @users('Portal user') + def test_project_milestone_portal_user_no_write(self): + with self.assertRaises(AccessError, msg=f"{self.env.user.name} should not be able to write in the project update"): + self.project_milestone.with_user(self.env.user).name = 'Test write' + + @users('Portal user') + def test_project_milestone_portal_user_no_create(self): + with self.assertRaises(AccessError, msg=f"{self.env.user.name} should not be able to create in the project update model"): + self.env['project.update'].with_user(self.env.user).create({ + 'name': 'Test Create with portal user', + 'project_id': self.project_pigs.id, + }) + + @users('Portal user') + def test_project_milestone_portal_user_no_unlink(self): + with self.assertRaises(AccessError, msg=f"{self.env.user.name} should not be able to unlink in the project update"): + self.project_milestone.with_user(self.env.user).unlink()