From 349556743b46ab7974433d31e8c2580cc77bce39 Mon Sep 17 00:00:00 2001
From: "psi (Open ERP)" <psi@tinyerp.co.in>
Date: Wed, 16 Feb 2011 16:17:15 +0530
Subject: [PATCH 1/3] [FIX] hr_*: new user - much too many access rights

lp bug: https://launchpad.net/bugs/719063 fixed

bzr revid: psi@tinyerp.co.in-20110216104715-ak6h09kyel4imt7e
---
 addons/hr/security/hr_security.xml          | 8 ++++++++
 addons/hr_evaluation/hr_evaluation_demo.xml | 8 +++++++-
 addons/hr_expense/security/ir_rule.xml      | 2 +-
 addons/hr_payroll/security/hr_security.xml  | 6 ++++++
 4 files changed, 22 insertions(+), 2 deletions(-)

diff --git a/addons/hr/security/hr_security.xml b/addons/hr/security/hr_security.xml
index 61aa5a93b12..caecf869ce6 100644
--- a/addons/hr/security/hr_security.xml
+++ b/addons/hr/security/hr_security.xml
@@ -9,5 +9,13 @@
     <record id="base.group_hr_user" model="res.groups">
         <field name="name">Human Resources / User</field>
     </record>
+
+     <record id="property_rule_employee" model="ir.rule">
+        <field name="name">Employee</field>
+        <field model="ir.model" name="model_id" ref="model_hr_employee"/>
+        <field name="domain_force">[('user_id','=',user.id)]</field>
+        <field name="groups" eval="[(4,ref('base.group_user'))]"/>
+    </record>
+
 </data>
 </openerp>
diff --git a/addons/hr_evaluation/hr_evaluation_demo.xml b/addons/hr_evaluation/hr_evaluation_demo.xml
index 59396717d49..682452a196b 100644
--- a/addons/hr_evaluation/hr_evaluation_demo.xml
+++ b/addons/hr_evaluation/hr_evaluation_demo.xml
@@ -1624,6 +1624,12 @@ Once the form had been filled, the employee send it to his supervisor.
             <field name="domain_force">['|',('employee_id.user_id','=',user.id),('employee_id.parent_id.user_id','=',user.id )]</field>
             <field name="groups" eval="[(4,ref('base.group_hr_manager'))]"/>
         </record>
-         </data>
+        <record id="property_rule_employee_evaluation" model="ir.rule">
+            <field name="name">Employee Evaluation</field>
+            <field model="ir.model" name="model_id" ref="model_hr_evaluation_evaluation"/>
+            <field name="domain_force">[('employee_id.user_id','=',user.id)]</field>
+            <field name="groups" eval="[(4,ref('base.group_user'))]"/>
+        </record>
+        </data>
 
 </openerp>
diff --git a/addons/hr_expense/security/ir_rule.xml b/addons/hr_expense/security/ir_rule.xml
index 292db38bf5e..d2686d2157c 100644
--- a/addons/hr_expense/security/ir_rule.xml
+++ b/addons/hr_expense/security/ir_rule.xml
@@ -17,7 +17,7 @@
         <record id="property_rule_expense_employee" model="ir.rule">
             <field name="name">Employee Expense</field>
             <field model="ir.model" name="model_id" ref="model_hr_expense_expense"/>
-            <field name="domain_force">[('employee_id.user_id','=',user.id)]</field>
+            <field name="domain_force">['|', ('employee_id.user_id','=',user.id), ('department_id.manager_id.user_id','=',user.id)]</field>
             <field name="groups" eval="[(4,ref('base.group_user'))]"/>
         </record>
 
diff --git a/addons/hr_payroll/security/hr_security.xml b/addons/hr_payroll/security/hr_security.xml
index 339fb1961b9..b9352e203e4 100644
--- a/addons/hr_payroll/security/hr_security.xml
+++ b/addons/hr_payroll/security/hr_security.xml
@@ -5,6 +5,12 @@
 <!--    <record id="group_hr_payroll" model="res.groups">-->
 <!--        <field name="name">Human Resources / Payroll</field>-->
 <!--    </record>-->
+     <record id="property_rule_employee_payroll" model="ir.rule">
+        <field name="name">Employee Payroll</field>
+        <field model="ir.model" name="model_id" ref="model_hr_payslip"/>
+        <field name="domain_force">[('employee_id.user_id','=',user.id)]</field>
+        <field name="groups" eval="[(4,ref('base.group_user'))]"/>
+    </record>
 
 </data>
 </openerp>
\ No newline at end of file

From 2167c599783f3e47791d31173e7f39cde152e5d0 Mon Sep 17 00:00:00 2001
From: "psi (Open ERP)" <psi@tinyerp.co.in>
Date: Wed, 16 Feb 2011 17:11:31 +0530
Subject: [PATCH 2/3] [IMP] hr_expense: small modification in access rule
 domain

bzr revid: psi@tinyerp.co.in-20110216114131-xcnhnq3s1pjxp9bc
---
 addons/hr_expense/security/ir_rule.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/addons/hr_expense/security/ir_rule.xml b/addons/hr_expense/security/ir_rule.xml
index d2686d2157c..292db38bf5e 100644
--- a/addons/hr_expense/security/ir_rule.xml
+++ b/addons/hr_expense/security/ir_rule.xml
@@ -17,7 +17,7 @@
         <record id="property_rule_expense_employee" model="ir.rule">
             <field name="name">Employee Expense</field>
             <field model="ir.model" name="model_id" ref="model_hr_expense_expense"/>
-            <field name="domain_force">['|', ('employee_id.user_id','=',user.id), ('department_id.manager_id.user_id','=',user.id)]</field>
+            <field name="domain_force">[('employee_id.user_id','=',user.id)]</field>
             <field name="groups" eval="[(4,ref('base.group_user'))]"/>
         </record>
 

From 6cc5d61e15ada94fd5120b065f1d23a208a8c636 Mon Sep 17 00:00:00 2001
From: "psi (Open ERP)" <psi@tinyerp.co.in>
Date: Wed, 16 Feb 2011 17:30:13 +0530
Subject: [PATCH 3/3] [IMP] hr_expense: small modification in access rule
 domain

bzr revid: psi@tinyerp.co.in-20110216120013-36760ok9u8x35qr2
---
 addons/hr_expense/security/ir_rule.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/addons/hr_expense/security/ir_rule.xml b/addons/hr_expense/security/ir_rule.xml
index 292db38bf5e..8e310f7f24b 100644
--- a/addons/hr_expense/security/ir_rule.xml
+++ b/addons/hr_expense/security/ir_rule.xml
@@ -5,7 +5,7 @@
         <record id="property_rule_expense" model="ir.rule">
             <field name="name">Employee Expense</field>
             <field model="ir.model" name="model_id" ref="model_hr_expense_expense"/>
-            <field name="domain_force">[('employee_id.user_id','=',user.id)]</field>
+            <field name="domain_force">['|', ('employee_id.user_id','=',user.id), ('department_id.manager_id.user_id','=',user.id)]</field>
             <field name="groups" eval="[(4,ref('base.group_hr_user'))]"/>
         </record>
         <record id="property_rule_expense_manager" model="ir.rule">