diff --git a/bin/addons/base/base_demo.xml b/bin/addons/base/base_demo.xml
index 6bfb81d570c..c6a578d3ce0 100644
--- a/bin/addons/base/base_demo.xml
+++ b/bin/addons/base/base_demo.xml
@@ -6,8 +6,6 @@
demo
Demo User
Fabien Pinckaers
-
-
diff --git a/bin/addons/base/base_security.xml b/bin/addons/base/base_security.xml
index 00b51359a83..065ee55f55a 100644
--- a/bin/addons/base/base_security.xml
+++ b/bin/addons/base/base_security.xml
@@ -70,10 +70,6 @@
Account Manager
-
- Partner Manager
-
-
Request
@@ -312,6 +308,19 @@
+
+
+ ir_actions_wizard group_employee
+
+
+
+
+
+
+
+
+
+
@@ -345,6 +354,56 @@
+
+ ir_model_fields group_employee
+
+
+
+
+
+
+
+
+
+ ir_module_category group_employee
+
+
+
+
+
+
+
+
+
+ ir_module_module group_employee
+
+
+
+
+
+
+
+
+
+ ir_rule group_employee
+
+
+
+
+
+
+
+
+
+ ir_rule_group group_employee
+
+
+
+
+
+
+
+
@@ -395,6 +454,36 @@
+
+ res_country group_employee
+
+
+
+
+
+
+
+
+
+ res_country_state group_employee
+
+
+
+
+
+
+
+
+
+ res_currency group_employee
+
+
+
+
+
+
+
+
res_currency_rate group_employee
@@ -445,16 +534,6 @@
-
- res_partner group_partner_manager
-
-
-
-
-
-
-
-
res_partner_address group_employee
@@ -465,26 +544,6 @@
-
- res_partner_address group_partner_manager
-
-
-
-
-
-
-
-
-
- res_partner_bank group_partner_manager
-
-
-
-
-
-
-
-
res_partner_bank group_employee
@@ -495,90 +554,90 @@
-
- res_partner_bank_type group_partner_manager
+
+ res_partner_bank_type group_employee
-
+
-
- res_partner_bank_type_field group_partner_manager
+
+ res_partner_bank_type_field group_employee
-
+
-
- res_partner_canal group_partner_manager
+
+ res_partner_canal group_employee
-
+
-
- res_partner_category group_partner_manager
+
+ res_partner_category group_employee
-
+
-
- res_partner_event group_partner_manager
+
+ res_partner_event group_employee
-
+
-
- res_partner_event_type group_partner_manager
+
+ res_partner_event_type group_employee
-
+
-
- res_partner_function group_partner_manager
+
+ res_partner_function group_employee
-
+
-
- res_partner_som group_partner_manager
+
+ res_partner_som group_employee
-
+
-
- res_partner_title group_partner_manager
+
+ res_partner_title group_employee
-
+
@@ -592,6 +651,36 @@
+
+
+
+
+ res_request group_employee
+
+
+
+
+
+
+
+
+
+ res_request_history group_employee
+
+
+
+
+
+
+
+
+
+ res_request_link group_employee
+
+
+
+
+
@@ -600,7 +689,7 @@
-
+
diff --git a/bin/addons/base/ir/ir.xml b/bin/addons/base/ir/ir.xml
index 12f1779088d..eb91d3dea5b 100644
--- a/bin/addons/base/ir/ir.xml
+++ b/bin/addons/base/ir/ir.xml
@@ -623,6 +623,7 @@
+
diff --git a/bin/addons/base/ir/ir_model.py b/bin/addons/base/ir/ir_model.py
index 0b2fb1e2769..d19406fa441 100644
--- a/bin/addons/base/ir/ir_model.py
+++ b/bin/addons/base/ir/ir_model.py
@@ -32,6 +32,8 @@ import ir, re
import netsvc
from osv.orm import except_orm
+from pprint import pprint
+
import time
import tools
import pooler
@@ -106,28 +108,33 @@ class ir_model(osv.osv):
result = super(osv.osv, self).read(cr, user, ids, fields, context, load)
if context and 'advanced' in context:
for res in result:
- rules = self.pool.get('ir.model.access').search(cr, user, [('model_id', '=', res['id'])])
- rules_br = self.pool.get('ir.model.access').browse(cr, user, rules)
- # Take into account the last found rule
- rules_br_len = len(rules_br) - 1
- if rules_br_len>-1:
- perm_list = []
- if rules_br[rules_br_len].perm_read:
- perm_list.append('r')
- if rules_br[rules_br_len].perm_write:
- perm_list.append('w')
- if rules_br[rules_br_len].perm_create:
- perm_list.append('c')
- if rules_br[rules_br_len].perm_unlink:
- perm_list.append('u')
- perms = ",".join(perm_list)
- res['group_%i'%rules_br[rules_br_len].group_id.id] = perms
+ if 'access' in res:
+ rules_br = self.pool.get('ir.model.access').browse(cr, user, res['access'])
+ else:
+ rules = self.pool.get('ir.model.access').search(cr, user, [('model_id', '=', res['id'])])
+ rules_br = self.pool.get('ir.model.access').browse(cr, user, rules)
+ if len(rules_br)>0:
+ for rule in rules_br:
+ perm_list = []
+ if rule.perm_read:
+ perm_list.append('r')
+ if rule.perm_write:
+ perm_list.append('w')
+ if rule.perm_create:
+ perm_list.append('c')
+ if rule.perm_unlink:
+ perm_list.append('u')
+ perms = ",".join(perm_list)
+ res['group_%i'%rule.group_id.id] = perms
+ pprint(result)
return result
def write(self, cr, user, ids, vals, context=None):
+ vals_new = vals.copy()
+
if context and 'advanced' in context:
- perms_rel = ['create','read','unlink','write']
- perms_all = ['c','r','u','w']
+ perms_rel = ['read','write','create','unlink']
+ perms_all = ['r','w','c','u']
perms = []
for val in vals:
@@ -158,6 +165,7 @@ class ir_model(osv.osv):
for k in req:
sql += '%s=%s,'%(k,req[k])
cr.execute("update ir_model_access set %s where id=%i"%(sql[:-1], rules[rule_len]))
+ print "update ir_model_access set %s where id=%i"%(sql[:-1], rules[rule_len])
else:
model_name = self.pool.get('ir.model').browse(cr, user, [model_id])[0].name
group_name = self.pool.get('res.groups').browse(cr, user, [group_id])[0].name
@@ -166,9 +174,9 @@ class ir_model(osv.osv):
(name, model_id, group_id, perm_create, perm_read, perm_unlink, perm_write) \
values (%s, %i, %i, %s, %s, %s, %s)',
(rule_name, model_id, group_id,req['perm_create'], req['perm_read'], req['perm_unlink'], req['perm_write'],))
- return 1
- else:
- return super(osv.osv, self).write(cr, user, ids, vals, context)
+ #return 1
+ del vals_new[val]
+ return super(osv.osv, self).write(cr, user, ids, vals_new, context)
def fields_get(self, cr, user, fields=None, context=None, read_access=True):
result = super(osv.osv, self).fields_get(cr, user, fields, context)
@@ -283,12 +291,13 @@ class ir_model_access(osv.osv):
res = False
return res
- def check(self, cr, uid, model_name, mode='read',raise_exception=True):
- assert mode in ['read','write','create','unlink'], 'Invalid access mode for security'
+ def check(self, cr, uid, model_name, mode='read',raise_exception=True):
# Users root have all access (Todo: exclude xml-rpc requests)
if uid==1:
return True
+ assert mode in ['read','write','create','unlink'], 'Invalid access mode for security'
+
# We check if a specific rule exists
cr.execute('SELECT MAX(CASE WHEN perm_'+mode+' THEN 1 else 0 END) '
'from ir_model_access a join ir_model m on (m.id=a.model_id) '
@@ -326,6 +335,10 @@ class ir_model_access(osv.osv):
res = super(ir_model_access, self).unlink(cr, uid, *args, **argv)
self.check()
return res
+ def read(self, cr, uid, *args, **argv):
+ res = super(ir_model_access, self).read(cr, uid, *args, **argv)
+ self.check()
+ return res
ir_model_access()
class ir_model_data(osv.osv):
diff --git a/bin/addons/base/res/res_security.xml b/bin/addons/base/res/res_security.xml
index 15423d1bd58..1ce91472707 100644
--- a/bin/addons/base/res/res_security.xml
+++ b/bin/addons/base/res/res_security.xml
@@ -13,6 +13,10 @@
Account Manager
+
+ Partner Manager
+
+
diff --git a/bin/addons/base/res/res_user.py b/bin/addons/base/res/res_user.py
index a7a7eb5f7f6..5454c0b0f5a 100644
--- a/bin/addons/base/res/res_user.py
+++ b/bin/addons/base/res/res_user.py
@@ -113,15 +113,6 @@ class users(osv.osv):
'context_lang': fields.selection(_lang_get, 'Language', required=True),
'context_tz': fields.selection(_tz_get, 'Timezone', size=64)
}
- def read(self,cr, uid, ids, fields=None, context=None, load='_classic_read'):
- result = super(users, self).read(cr, uid, ids, fields, context, load)
- canwrite = self.pool.get('ir.model.access').check(cr, uid, 'res.users', 'write', raise_exception=False)
- if not canwrite:
- for r in result:
- if 'password' in r:
- r['password'] = '********'
- return result
-
_sql_constraints = [
('login_key', 'UNIQUE (login)', 'You can not have two users with the same login !')
]
@@ -153,7 +144,7 @@ class users(osv.osv):
if (ids == [uid]):
ok = True
for k in values.keys():
- if k not in ('password','signature','action_id', 'context_lang', 'context_tz'):
+ if k not in ('password', 'signature', 'action_id', 'context_lang', 'context_tz'):
ok=False
if ok:
uid = 1
@@ -163,9 +154,18 @@ class users(osv.osv):
self.pool.get('ir.rule').domain_get()
return res
+ def read(self,cr, uid, ids, fields=None, context=None, load='_classic_read'):
+ result = super(users, self).read(cr, uid, ids, fields, context, load)
+ canwrite = self.pool.get('ir.model.access').check(cr, uid, 'res.users', 'write', raise_exception=False)
+ if not canwrite:
+ for r in result:
+ if 'password' in r:
+ r['password'] = '********'
+ return result
+
def unlink(self, cr, uid, ids):
if 1 in ids:
- raise osv.except_osv(_('Can not remove root user!'), _('You can not remove the root user as it is used internally for resources created by Tiny ERP (updates, module installation, ...)'))
+ raise osv.except_osv(_('Can not remove root user!'), _('You can not remove the root user as it is used internally for resources created by Open ERP (updates, module installation, ...)'))
return super(users, self).unlink(cr, uid, ids)
def name_search(self, cr, user, name='', args=None, operator='ilike', context=None, limit=80):