From 9ddfc18b4132daa395c4fa1591b1c001b8fb2628 Mon Sep 17 00:00:00 2001 From: Victor Feyens Date: Mon, 16 Mar 2020 09:50:32 +0100 Subject: [PATCH 1/2] [FIX] hr_recruitment: manager ACL should target manager group Hr user shouldn't have the rights to modify recruitment stages. --- addons/hr_recruitment/security/ir.model.access.csv | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/addons/hr_recruitment/security/ir.model.access.csv b/addons/hr_recruitment/security/ir.model.access.csv index 646f2a8857b..316301c53d1 100644 --- a/addons/hr_recruitment/security/ir.model.access.csv +++ b/addons/hr_recruitment/security/ir.model.access.csv @@ -1,7 +1,7 @@ id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink access_hr_applicant_user,hr.applicant.user,model_hr_applicant,group_hr_recruitment_user,1,1,1,1 access_hr_recruitment_stage_user,hr.recruitment.stage.user,model_hr_recruitment_stage,group_hr_recruitment_user,1,0,0,0 -access_hr_recruitment_stage_manager,hr.recruitment.stage.manager,model_hr_recruitment_stage,group_hr_recruitment_user,1,1,1,1 +access_hr_recruitment_stage_manager,hr.recruitment.stage.manager,model_hr_recruitment_stage,group_hr_recruitment_manager,1,1,1,1 access_hr_recruitment_degree,hr.recruitment.degree,model_hr_recruitment_degree,group_hr_recruitment_user,1,1,1,1 access_hr_recruitment_refuse_reason,hr.applicant.refuse.reason,model_hr_applicant_refuse_reason,group_hr_recruitment_user,1,1,1,1 access_res_partner_hr_user,res.partner.user,base.model_res_partner,group_hr_recruitment_user,1,1,1,1 From 066214b36b75dd9c95959798716df5c44ed012b1 Mon Sep 17 00:00:00 2001 From: Victor Feyens Date: Mon, 16 Mar 2020 09:51:53 +0100 Subject: [PATCH 2/2] [IMP] *: remove duplicate ACL targeting same group/model. In the same xml file (meaning one of the two rule is useless, or wrong if giving less rights than the other). Removing rules that had no impact will ease the understanding of security problems, by reducing the number of interconnecting rules. --- addons/account/security/ir.model.access.csv | 3 +-- addons/hr_expense/security/ir.model.access.csv | 6 ++---- addons/sale/security/ir.model.access.csv | 3 --- addons/sale_mrp/security/ir.model.access.csv | 1 - addons/website/security/ir.model.access.csv | 6 ++---- addons/website_event_track/security/ir.model.access.csv | 1 - 6 files changed, 5 insertions(+), 15 deletions(-) diff --git a/addons/account/security/ir.model.access.csv b/addons/account/security/ir.model.access.csv index 73f2f74d6ac..f58ef123d27 100644 --- a/addons/account/security/ir.model.access.csv +++ b/addons/account/security/ir.model.access.csv @@ -73,10 +73,9 @@ access_account_group,account.group,model_account_group,account.group_account_rea access_account_root_manager,account.root,model_account_root,account.group_account_manager,1,0,0,0 access_account_root,account.root,model_account_root,account.group_account_readonly,1,0,0,0 access_account_account_manager,account.account,model_account_account,account.group_account_manager,1,1,1,1 -access_account_account,account.account,model_account_account,account.group_account_readonly,1,0,0,0 +access_account_account,account.account.readonly,model_account_account,account.group_account_readonly,1,0,0,0 access_account_account_user,account.account user,model_account_account,base.group_user,1,0,0,0 access_account_account_partner_manager,account.account partner manager,model_account_account,base.group_partner_manager,1,0,0,0 -access_account_account_readonly,account.account invoice,model_account_account,account.group_account_readonly,1,0,0,0 access_account_account_invoice,account.account invoice,model_account_account,account.group_account_invoice,1,0,0,0 access_account_account_type_manager,account.account.type,model_account_account_type,account.group_account_manager,1,1,1,1 access_account_account_type_readonly,account.account.type readonly,model_account_account_type,account.group_account_readonly,1,0,0,0 diff --git a/addons/hr_expense/security/ir.model.access.csv b/addons/hr_expense/security/ir.model.access.csv index 8db618224fd..fa7bbe9f799 100644 --- a/addons/hr_expense/security/ir.model.access.csv +++ b/addons/hr_expense/security/ir.model.access.csv @@ -10,10 +10,8 @@ access_product_template_hr_expense_user,product.template.hr.expense.user,product access_uom_uom_hr_expense_user,uom.uom.hr.expense.user,uom.model_uom_uom,hr_expense.group_hr_expense_team_approver,1,1,1,1 access_account_journal_user,account.journal.user,account.model_account_journal,hr_expense.group_hr_expense_team_approver,1,1,1,1 access_account_journal_employee,account.journal.employee,account.model_account_journal,base.group_user,1,0,0,0 -access_account_invoice_user,account.invoice.user,account.model_account_move,hr_expense.group_hr_expense_team_approver,1,1,1,1 -access_account_invoice_line_user,account.invoice.line.user,account.model_account_move_line,hr_expense.group_hr_expense_team_approver,1,1,1,1 -access_account_move_user,account.move.user,account.model_account_move,hr_expense.group_hr_expense_team_approver,1,0,0,0 -access_account_move_line_user,account.move.line.user,account.model_account_move_line,hr_expense.group_hr_expense_team_approver,1,0,0,0 +access_account_move_user,account.move.hr.expense.approver,account.model_account_move,hr_expense.group_hr_expense_team_approver,1,1,1,1 +access_account_move_line_user,account.move.line.hr.expense.approver,account.model_account_move_line,hr_expense.group_hr_expense_team_approver,1,1,1,1 access_account_analytic_line_user,account.analytic.line.user,account.model_account_analytic_line,hr_expense.group_hr_expense_team_approver,1,1,1,1 access_mail_activity_type_expense_user,mail.activity.type.expense.user,mail.model_mail_activity_type,hr_expense.group_hr_expense_manager,1,1,1,1 access_hr_expense_refuse_wizard,access.hr.expense.refuse.wizard,model_hr_expense_refuse_wizard,hr_expense.group_hr_expense_team_approver,1,1,1,0 diff --git a/addons/sale/security/ir.model.access.csv b/addons/sale/security/ir.model.access.csv index d3bc9376ed8..c09cd3a62ff 100644 --- a/addons/sale/security/ir.model.access.csv +++ b/addons/sale/security/ir.model.access.csv @@ -36,9 +36,7 @@ access_product_supplierinfo_user,product.supplierinfo.user,product.model_product access_product_supplierinfo_sale_manager,product.supplierinfo salemanager,product.model_product_supplierinfo,sales_team.group_sale_manager,1,1,1,1 access_product_pricelist_sale_manager,product.pricelist salemanager,product.model_product_pricelist,sales_team.group_sale_manager,1,1,1,1 access_product_group_res_partner_sale_manager,res_partner group_sale_manager,base.model_res_partner,sales_team.group_sale_manager,1,1,1,0 -access_sale_order_invoicing_payments_readonly,sale.order,model_sale_order,account.group_account_readonly,1,0,0,0 access_sale_order_invoicing_payments,sale.order,model_sale_order,account.group_account_invoice,1,1,0,0 -access_sale_order_line_invoicing_payments_readonly,sale.order.line,model_sale_order_line,account.group_account_readonly,1,0,0,0 access_sale_order_line_invoicing_payments,sale.order.line,model_sale_order_line,account.group_account_invoice,1,1,0,0 access_product_pricelist_item_sale_manager,product.pricelist.item salemanager,product.model_product_pricelist_item,sales_team.group_sale_manager,1,1,1,1 access_product_template_sale_manager,product.template salemanager,model_product_template,sales_team.group_sale_manager,1,1,1,1 @@ -50,7 +48,6 @@ access_product_product_attribute_custom_value,product.attribute.custom value man access_product_template_attribute_exclusion_sale_manager,product.attribute manager filter line,product.model_product_template_attribute_exclusion,sales_team.group_sale_manager,1,1,1,1 access_product_template_attribute_line_sale_manager,product.attribute manager line,product.model_product_template_attribute_line,sales_team.group_sale_manager,1,1,1,1 access_account_tax_sale_manager,account.tax sale manager,account.model_account_tax,sales_team.group_sale_salesman,1,0,0,0 -access_account_journal_sale_manager,account.journal sale manager,account.model_account_journal,sales_team.group_sale_salesman,1,0,0,0 access_account_tax_group_sale_manager,account.tax.group sale manager,account.model_account_tax_group,sales_team.group_sale_salesman,1,0,0,0 access_account_account_sale_manager,account.account sale manager,account.model_account_account,sales_team.group_sale_manager,1,0,0,0 access_mail_activity_type_sale_manager,mail.activity.type.sale.manager,mail.model_mail_activity_type,sales_team.group_sale_manager,1,1,1,1 diff --git a/addons/sale_mrp/security/ir.model.access.csv b/addons/sale_mrp/security/ir.model.access.csv index 89b6ae97957..8271138557b 100644 --- a/addons/sale_mrp/security/ir.model.access.csv +++ b/addons/sale_mrp/security/ir.model.access.csv @@ -4,5 +4,4 @@ access_sale_order_manufacturing_user,sale.order manufacturing.user,sale.model_sa access_sale_order_line_manufacturing_user,sale.order.line manufacturing.user,sale.model_sale_order_line,mrp.group_mrp_user,1,1,0,0 access_mrp_production_salesman,mrp.production salesman,mrp.model_mrp_production,sales_team.group_sale_salesman,1,1,1,0 access_mrp_production_workcenter_line_salesman,mrp.workorder salesman,mrp.model_mrp_workorder,sales_team.group_sale_salesman,1,0,1,0 -access_mrp_bom_salesman,mrp.bom,mrp.model_mrp_bom,sales_team.group_sale_salesman,1,0,0,0 access_mrp_bom_line_salesman,mrp.bom.line,mrp.model_mrp_bom_line,sales_team.group_sale_salesman,1,0,0,0 diff --git a/addons/website/security/ir.model.access.csv b/addons/website/security/ir.model.access.csv index daa7630f376..44a2347e3a0 100644 --- a/addons/website/security/ir.model.access.csv +++ b/addons/website/security/ir.model.access.csv @@ -1,16 +1,14 @@ id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink -access_website_public,website,website.model_website,,1,0,0,0 -access_website_designer,website,website.model_website,group_website_designer,1,1,1,1 +access_website_public,website.public,website.model_website,,1,0,0,0 +access_website_designer,website.website.designer,website.model_website,group_website_designer,1,1,1,1 access_website_menu,access_website_menu,model_website_menu,,1,0,0,0 access_website_menu_designer,Web Menu Manager,model_website_menu,group_website_designer,1,1,1,1 access_website_rewrite,access_website_rewrite,model_website_rewrite,,0,0,0,0 access_website_rewrite_designer,Web Rewrite Manager,model_website_rewrite,group_website_designer,1,1,1,1 access_website_page,access_website_page,model_website_page,,1,0,0,0 access_website_page_designer,Web Page Manager,model_website_page,group_website_designer,1,1,1,1 -access_website,web menu manager,website.model_website,group_website_designer,1,1,1,1 access_website_ir_ui_view,access_website_ir_ui_view,model_ir_ui_view,group_website_designer,1,1,1,1 access_seo_public,access_seo_public,model_website_seo_metadata,,1,0,0,0 -access_seo_manager,access_seo_manager,model_website_seo_metadata,group_website_designer,1,1,1,1 access_seo_designer,access_seo_designer,model_website_seo_metadata,group_website_designer,1,1,1,1 access_website_visitor_designer,access_website_visitor_designer,model_website_visitor,website.group_website_designer,1,1,0,1 access_website_visitor_system,access_website_visitor_system,model_website_visitor,base.group_system,1,1,1,1 diff --git a/addons/website_event_track/security/ir.model.access.csv b/addons/website_event_track/security/ir.model.access.csv index 92d7e20059e..8c5e7569aba 100644 --- a/addons/website_event_track/security/ir.model.access.csv +++ b/addons/website_event_track/security/ir.model.access.csv @@ -1,5 +1,4 @@ id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink -access_event_location_manager,event.track.location manager,model_event_track_location,event.group_event_manager,1,1,1,1 access_event_track_manager,event.track manager,model_event_track,event.group_event_manager,1,1,1,1 access_event_track_tag_public,event.track.tag public,model_event_track_tag,,1,0,0,0 access_event_track_tag_manager,event.track.tag manager,model_event_track_tag,event.group_event_manager,1,1,1,1