From c75147bb1ee9085a0cea0bc606c0152e494ba7f0 Mon Sep 17 00:00:00 2001
From: Denis Ledoux <dle@odoo.com>
Date: Thu, 26 Oct 2023 15:09:54 +0200
Subject: [PATCH] [IMP] mail: restrict `create` for internal same as `write` &
 `read`
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Before this revision, an employee could create a discuss channel
with whatever setup he wants.
Which is fine. The critical part is for an employee to not be able
to join an existing restricted channel.
But creating a channel is not a problem.

However, he would be able to create a channel for which
he doesn't have access, meaning he creates the channel
and then no longer see it, which is not user-friendly.

closes odoo/odoo#139903

Signed-off-by: Sébastien Theys (seb) <seb@odoo.com>
---
 addons/mail/security/mail_security.xml                   | 2 --
 addons/mail/tests/discuss/test_discuss_channel_access.py | 2 +-
 2 files changed, 1 insertion(+), 3 deletions(-)

diff --git a/addons/mail/security/mail_security.xml b/addons/mail/security/mail_security.xml
index 1e2266a309f..279825269cb 100644
--- a/addons/mail/security/mail_security.xml
+++ b/addons/mail/security/mail_security.xml
@@ -23,8 +23,6 @@
                                 ('group_public_id', 'in', user.groups_id.ids)
                 ]
             </field>
-            <field name="perm_create" eval="False"/><!-- create follows access rules (allowed for internal and system) -->
-            <field name="perm_unlink" eval="False"/><!-- unlink follows access rules (allowed for system) -->
         </record>
 
         <record id="ir_rule_discuss_channel_group_system" model="ir.rule">
diff --git a/addons/mail/tests/discuss/test_discuss_channel_access.py b/addons/mail/tests/discuss/test_discuss_channel_access.py
index bdbdfb45dd7..3b83e155e87 100644
--- a/addons/mail/tests/discuss/test_discuss_channel_access.py
+++ b/addons/mail/tests/discuss/test_discuss_channel_access.py
@@ -123,7 +123,7 @@ class TestDiscussChannelAccess(MailCommon):
             ("user", "group_failing", "member", "read", False),
             ("user", "group_failing", "member", "write", False),
             ("user", "group_failing", "member", "unlink", False),
-            ("user", "group_failing", "outside", "create", True),
+            ("user", "group_failing", "outside", "create", False),
             ("user", "group_failing", "outside", "read", False),
             ("user", "group_failing", "outside", "write", False),
             ("user", "group_failing", "outside", "unlink", False),