From b82a1ae38b0eb72bdf39f32a87b6431a91628939 Mon Sep 17 00:00:00 2001
From: "dane@odoo.com" <dane@odoo.com>
Date: Thu, 18 Apr 2024 13:25:09 +0200
Subject: [PATCH] [FIX] mail: update security rules

Since the introduction of `user_id` field, it makes sense to allow
those users to update/read/delete templates they have been assigned to.

task-3748816

closes odoo/odoo#162400

Signed-off-by: Thibault Delavallee (tde) <tde@openerp.com>
---
 addons/mail/security/mail_security.xml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/addons/mail/security/mail_security.xml b/addons/mail/security/mail_security.xml
index 97d727f7379..e106e56d3d9 100644
--- a/addons/mail/security/mail_security.xml
+++ b/addons/mail/security/mail_security.xml
@@ -234,9 +234,9 @@
         </record>
 
         <record id="mail_template_employee_rule" model="ir.rule">
-            <field name="name">Employees can only change their own templates</field>
+            <field name="name">Employees can only modify templates they have created or been assigned</field>
             <field name="model_id" ref="model_mail_template"/>
-            <field name="domain_force">[('create_uid', '=', user.id)]</field>
+            <field name="domain_force">['|', ('create_uid', '=', user.id), ('user_id', '=', user.id)]</field>
             <field name="groups" eval="[Command.link(ref('base.group_user'))]"/>
             <field name="perm_create" eval="True"/>
             <field name="perm_read" eval="False"/>