From abdca55ea2f5a4296ef46d3b9562a21eb955272f Mon Sep 17 00:00:00 2001
From: Yannick Tivisse <yti@odoo.com>
Date: Mon, 7 Mar 2016 10:04:16 +0100
Subject: [PATCH] [FIX] User with 'Access Rights' rights not able to access
 Users menu

The ERP managers (users with 'Access Rights' rights) cannot even click on
the Settings app menuitem. Because of 2 things:
- The Dashboard settings is accessing the model ir_module_module. So
  we set a groups 'group_settings' on it.
- The Users view is accessing the model ir_module_category to groups
  the aggregate and display the settings. So we change the security rules
  by giving the access to the group_erp_manager instead of group_settings
- The global rules opn companies was applied to the erp managers. We
  splitted this ir.rules into three new ones on portal,public and employee
  users to allow the erp managers to access the companies
- Writing on the res_groups was calling the method _update_user_groups_view
  in all the cases. This method should be called only when the view was
  needed to be modified, i.e. when the category_id is modified for this
  group.
---
 addons/base_setup/res_config_view.xml         |  2 +-
 .../views/dashboard_views.xml                 |  2 +-
 openerp/addons/base/base_menu.xml             |  2 +-
 openerp/addons/base/res/res_security.xml      | 24 +++++++++++++++----
 openerp/addons/base/res/res_users.py          |  5 ++--
 .../addons/base/security/ir.model.access.csv  |  2 +-
 openerp/addons/base/tests/test_ir_rule.yml    |  2 +-
 7 files changed, 27 insertions(+), 12 deletions(-)

diff --git a/addons/base_setup/res_config_view.xml b/addons/base_setup/res_config_view.xml
index 6067af0ca52..a18fbce50e4 100644
--- a/addons/base_setup/res_config_view.xml
+++ b/addons/base_setup/res_config_view.xml
@@ -114,7 +114,7 @@
             <field name="view_mode">form</field>
             <field name="target">inline</field>
         </record>
-        <menuitem id="base.menu_config" name="General Settings" parent="base.menu_administration" sequence="1" action="action_general_configuration"/>
+        <menuitem id="base.menu_config" name="General Settings" parent="base.menu_administration" sequence="1" action="action_general_configuration" groups="base.group_system"/>
 
 
         <!-- Sale config wizard -->
diff --git a/addons/web_settings_dashboard/views/dashboard_views.xml b/addons/web_settings_dashboard/views/dashboard_views.xml
index 3bf85772f4b..2a051860708 100644
--- a/addons/web_settings_dashboard/views/dashboard_views.xml
+++ b/addons/web_settings_dashboard/views/dashboard_views.xml
@@ -4,5 +4,5 @@
         <field name="name">Dashboard</field>
         <field name="tag">web_settings_dashboard.main</field>
     </record>
-    <menuitem name="Dashboard" id="web_dashboard_menu" action="web_settings_dashboard_action" parent="base.menu_administration" sequence="-1" />
+    <menuitem name="Dashboard" id="web_dashboard_menu" action="web_settings_dashboard_action" parent="base.menu_administration" sequence="-1" groups="base.group_system"/>
 </odoo>
diff --git a/openerp/addons/base/base_menu.xml b/openerp/addons/base/base_menu.xml
index e8e33230148..bdacce6ff4c 100644
--- a/openerp/addons/base/base_menu.xml
+++ b/openerp/addons/base/base_menu.xml
@@ -11,7 +11,7 @@
           icon="fa-cog"
           web_icon="base,static/description/settings.png"
           sequence="500"
-          groups="base.group_system"/>
+          groups="base.group_erp_manager"/>
           <menuitem id="menu_management" name="Apps" sequence="310" web_icon="base,static/description/modules.png" groups="base.group_system"/>
           <menuitem id="menu_administration_shortcut" parent="menu_administration" name="Custom Shortcuts" sequence="50"/>
           <menuitem id="menu_users" name="Users" parent="menu_administration" sequence="0"/>
diff --git a/openerp/addons/base/res/res_security.xml b/openerp/addons/base/res/res_security.xml
index a5f7550492c..35c0c5e4521 100644
--- a/openerp/addons/base/res/res_security.xml
+++ b/openerp/addons/base/res/res_security.xml
@@ -11,12 +11,26 @@
             <field eval="[(6,0,[ref('group_system'), ref('group_partner_manager')])]" name="groups_id"/>
         </record>
 
-        <!-- Record Rule For Company -->
-        <record id="res_company_rule" model="ir.rule">
-            <field name="name">company rule</field>
+        <!-- Record Rules For Company -->
+        <record id="res_company_rule_portal" model="ir.rule">
+            <field name="name">company rule portal</field>
             <field name="model_id" ref="model_res_company"/>
-            <field eval="True" name="global"/>
-            <!-- TODO: review this <field name="domain_force">['|', ('child_ids', 'child_of', [user.company_id.id]), ('parent_id', 'child_of', [user.company_id.id])]</field> -->
+            <field eval="False" name="global"/>
+            <field name="groups" eval="[(6, 0, [ref('base.group_portal')])]"/>
+            <field name="domain_force">[('id','child_of',[user.company_id.id])]</field>
+        </record>
+        <record id="res_company_rule_employee" model="ir.rule">
+            <field name="name">company rule employee</field>
+            <field name="model_id" ref="model_res_company"/>
+            <field eval="False" name="global"/>
+            <field name="groups" eval="[(6, 0, [ref('base.group_user')])]"/>
+            <field name="domain_force">[('id','child_of',[user.company_id.id])]</field>
+        </record>
+        <record id="res_company_rule_public" model="ir.rule">
+            <field name="name">company rule public</field>
+            <field name="model_id" ref="model_res_company"/>
+            <field eval="False" name="global"/>
+            <field name="groups" eval="[(6, 0, [ref('base.group_public')])]"/>
             <field name="domain_force">[('id','child_of',[user.company_id.id])]</field>
         </record>
 
diff --git a/openerp/addons/base/res/res_users.py b/openerp/addons/base/res/res_users.py
index 00f30c4bc83..c657e3ba847 100644
--- a/openerp/addons/base/res/res_users.py
+++ b/openerp/addons/base/res/res_users.py
@@ -183,7 +183,7 @@ class Users(models.Model):
         return (default_user or self.env['res.users']).groups_id
 
     def _companies_count(self):
-        return self.env['res.company'].search_count([])
+        return self.env['res.company'].sudo().search_count([])
 
     partner_id = fields.Many2one('res.partner', required=True, ondelete='restrict', auto_join=True,
         string='Related Partner', help='Partner-related data of the user')
@@ -674,7 +674,8 @@ class GroupsView(models.Model):
     @api.multi
     def write(self, values):
         res = super(GroupsView, self).write(values)
-        self._update_user_groups_view()
+        if 'category_id' in values:
+            self._update_user_groups_view()
         # ir_values.get_actions() depends on action records
         self.env['ir.values'].clear_caches()
         return res
diff --git a/openerp/addons/base/security/ir.model.access.csv b/openerp/addons/base/security/ir.model.access.csv
index 21a18587c18..1736580b147 100644
--- a/openerp/addons/base/security/ir.model.access.csv
+++ b/openerp/addons/base/security/ir.model.access.csv
@@ -17,7 +17,7 @@
 "access_ir_model_data_all","ir_model_data all","model_ir_model_data",,1,0,0,0
 "access_ir_model_data_user","ir_model_data user","model_ir_model_data",base.group_user,1,0,1,0
 "access_ir_model_fields_all","ir_model_fields all","model_ir_model_fields",,1,0,0,0
-"access_ir_module_category_group_user","ir_module_category group_user","model_ir_module_category","group_system",1,0,0,0
+"access_ir_module_category_group_user","ir_module_category group_user","model_ir_module_category","group_erp_manager",1,0,0,0
 "access_ir_module_module_group_user","ir_module_module group_user","model_ir_module_module","group_system",1,1,1,1
 "access_ir_module_module_dependency_group_system","ir_module_module_dependency group_system","model_ir_module_module_dependency","group_system",1,1,1,1
 "access_ir_property_group_user","ir_property group_user","model_ir_property",,1,0,0,0
diff --git a/openerp/addons/base/tests/test_ir_rule.yml b/openerp/addons/base/tests/test_ir_rule.yml
index 82e8b0c14a7..02fc2e3d3b4 100644
--- a/openerp/addons/base/tests/test_ir_rule.yml
+++ b/openerp/addons/base/tests/test_ir_rule.yml
@@ -124,7 +124,7 @@
     Modify the global rule on res_company which triggers a recursive check
     of the rules on company.
 -
-    !record {model: ir.rule, id: res_company_rule}:
+    !record {model: ir.rule, id: res_company_rule_employee}:
         domain_force: "[('id','child_of',[user.company_id.id])]"
 -
     Read as demo user the partners (exercising the global company rule).