[FIX] User with 'Access Rights' rights not able to access Users menu

The ERP managers (users with 'Access Rights' rights) cannot even click on
the Settings app menuitem. Because of 2 things:
- The Dashboard settings is accessing the model ir_module_module. So
  we set a groups 'group_settings' on it.
- The Users view is accessing the model ir_module_category to groups
  the aggregate and display the settings. So we change the security rules
  by giving the access to the group_erp_manager instead of group_settings
- The global rules opn companies was applied to the erp managers. We
  splitted this ir.rules into three new ones on portal,public and employee
  users to allow the erp managers to access the companies
- Writing on the res_groups was calling the method _update_user_groups_view
  in all the cases. This method should be called only when the view was
  needed to be modified, i.e. when the category_id is modified for this
  group.

addons/base_setup/res_config_view.xml

@@ -114,7 +114,7 @@
             <field name="view_mode">form</field>
             <field name="target">inline</field>
         </record>
-        <menuitem id="base.menu_config" name="General Settings" parent="base.menu_administration" sequence="1" action="action_general_configuration"/>
+        <menuitem id="base.menu_config" name="General Settings" parent="base.menu_administration" sequence="1" action="action_general_configuration" groups="base.group_system"/>
 
 
         <!-- Sale config wizard -->

addons/web_settings_dashboard/views/dashboard_views.xml

@@ -4,5 +4,5 @@
         <field name="name">Dashboard</field>
         <field name="tag">web_settings_dashboard.main</field>
     </record>
-    <menuitem name="Dashboard" id="web_dashboard_menu" action="web_settings_dashboard_action" parent="base.menu_administration" sequence="-1" />
+    <menuitem name="Dashboard" id="web_dashboard_menu" action="web_settings_dashboard_action" parent="base.menu_administration" sequence="-1" groups="base.group_system"/>
 </odoo>

openerp/addons/base/base_menu.xml

@@ -11,7 +11,7 @@
           icon="fa-cog"
           web_icon="base,static/description/settings.png"
           sequence="500"
-          groups="base.group_system"/>
+          groups="base.group_erp_manager"/>
           <menuitem id="menu_management" name="Apps" sequence="310" web_icon="base,static/description/modules.png" groups="base.group_system"/>
           <menuitem id="menu_administration_shortcut" parent="menu_administration" name="Custom Shortcuts" sequence="50"/>
           <menuitem id="menu_users" name="Users" parent="menu_administration" sequence="0"/>

openerp/addons/base/res/res_security.xml

@@ -11,12 +11,26 @@
             <field eval="[(6,0,[ref('group_system'), ref('group_partner_manager')])]" name="groups_id"/>
         </record>
 
-        <!-- Record Rule For Company -->
-        <record id="res_company_rule" model="ir.rule">
-            <field name="name">company rule</field>
+        <!-- Record Rules For Company -->
+        <record id="res_company_rule_portal" model="ir.rule">
+            <field name="name">company rule portal</field>
             <field name="model_id" ref="model_res_company"/>
-            <field eval="True" name="global"/>
-            <!-- TODO: review this <field name="domain_force">['|', ('child_ids', 'child_of', [user.company_id.id]), ('parent_id', 'child_of', [user.company_id.id])]</field> -->
+            <field eval="False" name="global"/>
+            <field name="groups" eval="[(6, 0, [ref('base.group_portal')])]"/>
+            <field name="domain_force">[('id','child_of',[user.company_id.id])]</field>
+        </record>
+        <record id="res_company_rule_employee" model="ir.rule">
+            <field name="name">company rule employee</field>
+            <field name="model_id" ref="model_res_company"/>
+            <field eval="False" name="global"/>
+            <field name="groups" eval="[(6, 0, [ref('base.group_user')])]"/>
+            <field name="domain_force">[('id','child_of',[user.company_id.id])]</field>
+        </record>
+        <record id="res_company_rule_public" model="ir.rule">
+            <field name="name">company rule public</field>
+            <field name="model_id" ref="model_res_company"/>
+            <field eval="False" name="global"/>
+            <field name="groups" eval="[(6, 0, [ref('base.group_public')])]"/>
             <field name="domain_force">[('id','child_of',[user.company_id.id])]</field>
         </record>
 

openerp/addons/base/res/res_users.py

@@ -183,7 +183,7 @@ class Users(models.Model):
         return (default_user or self.env['res.users']).groups_id
 
     def _companies_count(self):
-        return self.env['res.company'].search_count([])
+        return self.env['res.company'].sudo().search_count([])
 
     partner_id = fields.Many2one('res.partner', required=True, ondelete='restrict', auto_join=True,
         string='Related Partner', help='Partner-related data of the user')
@@ -674,7 +674,8 @@ class GroupsView(models.Model):
     @api.multi
     def write(self, values):
         res = super(GroupsView, self).write(values)
-        self._update_user_groups_view()
+        if 'category_id' in values:
+            self._update_user_groups_view()
         # ir_values.get_actions() depends on action records
         self.env['ir.values'].clear_caches()
         return res

openerp/addons/base/security/ir.model.access.csv

@@ -17,7 +17,7 @@
 "access_ir_model_data_all","ir_model_data all","model_ir_model_data",,1,0,0,0
 "access_ir_model_data_user","ir_model_data user","model_ir_model_data",base.group_user,1,0,1,0
 "access_ir_model_fields_all","ir_model_fields all","model_ir_model_fields",,1,0,0,0
-"access_ir_module_category_group_user","ir_module_category group_user","model_ir_module_category","group_system",1,0,0,0
+"access_ir_module_category_group_user","ir_module_category group_user","model_ir_module_category","group_erp_manager",1,0,0,0
 "access_ir_module_module_group_user","ir_module_module group_user","model_ir_module_module","group_system",1,1,1,1
 "access_ir_module_module_dependency_group_system","ir_module_module_dependency group_system","model_ir_module_module_dependency","group_system",1,1,1,1
 "access_ir_property_group_user","ir_property group_user","model_ir_property",,1,0,0,0

openerp/addons/base/tests/test_ir_rule.yml

@@ -124,7 +124,7 @@
     Modify the global rule on res_company which triggers a recursive check
     of the rules on company.
 -
-    !record {model: ir.rule, id: res_company_rule}:
+    !record {model: ir.rule, id: res_company_rule_employee}:
         domain_force: "[('id','child_of',[user.company_id.id])]"
 -
     Read as demo user the partners (exercising the global company rule).