[FIX] hr_attendance: prevent the edition of employee_id

Issue:
A user has write access rights to modify his own attendances.
However, he can modify the `employee_id` field.
This can cause attendances to be moved to other employees.

opw-3280850

closes odoo/odoo#120632

X-original-commit: 1c25a9b964e9e2acf9d431897e83cf72ecdca1cb
Signed-off-by: Kevin Baptiste <kba@odoo.com>
Signed-off-by: Lefebvre Thomas (thle) <thle@odoo.com>

addons/hr_attendance/i18n/hr_attendance.pot

@@ -453,6 +453,14 @@ msgstr ""
 msgid "Display Name"
 msgstr ""
 
+#. module: hr_attendance
+#. odoo-python
+#: code:addons/hr_attendance/models/hr_attendance.py:0
+#, python-format
+msgid ""
+"Do not have access, user cannot edit the attendances that are not his own."
+msgstr ""
+
 #. module: hr_attendance
 #: model_terms:ir.ui.view,arch_db:hr_attendance.res_config_settings_view_form
 msgid "Display Time"

addons/hr_attendance/models/hr_attendance.py

@@ -13,6 +13,7 @@ from odoo.addons.resource.models.utils import Intervals
 from odoo.tools import format_datetime
 from odoo.osv.expression import AND, OR
 from odoo.tools.float_utils import float_is_zero
+from odoo.exceptions import AccessError
 
 
 class HrAttendance(models.Model):
@@ -300,6 +301,10 @@ class HrAttendance(models.Model):
         return res
 
     def write(self, vals):
+        if vals.get('employee_id') and \
+            vals['employee_id'] not in self.env.user.employee_ids.ids and \
+            not self.env.user.has_group('hr_attendance.group_hr_attendance_user'):
+            raise AccessError(_("Do not have access, user cannot edit the attendances that are not his own."))
         attendances_dates = self._get_attendances_dates()
         result = super(HrAttendance, self).write(vals)
         if any(field in vals for field in ['employee_id', 'check_in', 'check_out']):