From c478e94450374176f0dcb97f1fa3d71b8d3dbd93 Mon Sep 17 00:00:00 2001
From: Nicolas Martinelli <nim@odoo.com>
Date: Fri, 25 Aug 2017 16:07:39 +0200
Subject: [PATCH] [FIX] hr_expense: delete expense

A regular employee is allowed to delete an expense reported already
approved. This should not be possible, only an officer could do it.

Fixes #19044
opw-767549
---
 addons/hr_expense/security/ir_rule.xml | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/addons/hr_expense/security/ir_rule.xml b/addons/hr_expense/security/ir_rule.xml
index 61aba78d7ed..e86d91211d8 100644
--- a/addons/hr_expense/security/ir_rule.xml
+++ b/addons/hr_expense/security/ir_rule.xml
@@ -26,6 +26,26 @@
             <field eval="True" name="global"/>
             <field name="domain_force">['|',('company_id', '=', False), ('company_id', 'child_of', [user.company_id.id])]</field>
         </record>
+        <record id="hr_expense_report_prevent_unlink" model="ir.rule">
+            <field name="name">Expense Report Prevent Delete Employee</field>
+            <field name="model_id" ref="model_hr_expense_sheet"/>
+            <field name="domain_force">[('state', '=', 'submit')]</field>
+            <field name="groups" eval="[(4, ref('base.group_user'))]"/>
+            <field name="perm_read" eval="False"/>
+            <field name="perm_write" eval="False"/>
+            <field name="perm_create" eval="False"/>
+            <field name="perm_unlink" eval="True"/>
+        </record>
+        <record id="hr_expense_report_auth_unlink" model="ir.rule">
+            <field name="name">Expense Report Authorize Delete Officer</field>
+            <field name="model_id" ref="model_hr_expense_sheet"/>
+            <field name="domain_force">[(1, '=', 1)]</field>
+            <field name="groups" eval="[(4, ref('hr_expense.group_hr_expense_user'))]"/>
+            <field name="perm_read" eval="False"/>
+            <field name="perm_write" eval="False"/>
+            <field name="perm_create" eval="False"/>
+            <field name="perm_unlink" eval="True"/>
+        </record>
 
     </data>
 </odoo>