From d1c6bc5d956ec25989d1c8771a02679624b645ff Mon Sep 17 00:00:00 2001
From: "Julien Carion (juca)" <juca@odoo.com>
Date: Thu, 10 Aug 2023 08:29:20 +0000
Subject: [PATCH] [FIX] mail, base: move user settings access rules

In b1e2c3453f50cc05a1b03dc1c8571a01ad7b7dd2, the `res.users.settings`
model was moved from `mail/` to `base/`, but its record rules remained
in `mail/`. This means that if `mail/` is not installed, users will be
able to access other users' `res.users.settings` records. In practice,
this is not a problem, as the only field that can exist in
`res.users.settings` without `mail/` is `homemenu_config`, which
contains nothing senstive.

This commit moves the forgotten record rules to `base/`, preventing
potential problems if new fields with sensitive information were to be
added to `res.users.settings` in the future.

Task-3461652

closes odoo/odoo#131538

X-original-commit: 5a79550c8e35ce733375c2ef7df2ea12e6added6
Signed-off-by: Louis Wicket (wil) <wil@odoo.com>
---
 addons/mail/security/mail_security.xml      | 22 --------------------
 odoo/addons/base/security/base_security.xml | 23 +++++++++++++++++++++
 2 files changed, 23 insertions(+), 22 deletions(-)

diff --git a/addons/mail/security/mail_security.xml b/addons/mail/security/mail_security.xml
index 0cb01ebbfc0..f800bb7ad3e 100644
--- a/addons/mail/security/mail_security.xml
+++ b/addons/mail/security/mail_security.xml
@@ -129,28 +129,6 @@
             <field name="perm_unlink" eval="True"/>
         </record>
 
-        <record id="res_users_settings_rule_admin" model="ir.rule">
-            <field name="name">Administrators can access all User Settings.</field>
-            <field name="model_id" ref="model_res_users_settings"/>
-            <field name="groups" eval="[Command.link(ref('base.group_system'))]"/>
-            <field name="domain_force">[(1, '=', 1)]</field>
-            <field name="perm_read" eval="True"/>
-            <field name="perm_write" eval="True"/>
-            <field name="perm_create" eval="True"/>
-            <field name="perm_unlink" eval="True"/>
-        </record>
-
-        <record id="res_users_settings_rule_user" model="ir.rule">
-            <field name="name">res.users.settings: access their own entries</field>
-            <field name="model_id" ref="model_res_users_settings"/>
-            <field name="groups" eval="[Command.link(ref('base.group_user'))]"/>
-            <field name="domain_force">[('user_id', '=', user.id)]</field>
-            <field name="perm_read" eval="True"/>
-            <field name="perm_write" eval="True"/>
-            <field name="perm_create" eval="True"/>
-            <field name="perm_unlink" eval="True"/>
-        </record>
-
         <record id="res_users_settings_volumes_rule_user" model="ir.rule">
             <field name="name">res.users.settings.volumes: access their own entries</field>
             <field name="model_id" ref="model_res_users_settings_volumes"/>
diff --git a/odoo/addons/base/security/base_security.xml b/odoo/addons/base/security/base_security.xml
index 700bbc527fb..9099f835b15 100644
--- a/odoo/addons/base/security/base_security.xml
+++ b/odoo/addons/base/security/base_security.xml
@@ -158,6 +158,29 @@
             <field name="domain_force">[('create_uid', '=', user.id)]</field>
         </record>
 
+        <!-- Record Rule For User settings -->
+        <record id="res_users_settings_rule_admin" model="ir.rule">
+            <field name="name">Administrators can access all User Settings.</field>
+            <field name="model_id" ref="model_res_users_settings"/>
+            <field name="groups" eval="[Command.link(ref('base.group_system'))]"/>
+            <field name="domain_force">[(1, '=', 1)]</field>
+            <field name="perm_read" eval="True"/>
+            <field name="perm_write" eval="True"/>
+            <field name="perm_create" eval="True"/>
+            <field name="perm_unlink" eval="True"/>
+        </record>
+
+        <record id="res_users_settings_rule_user" model="ir.rule">
+            <field name="name">res.users.settings: access their own entries</field>
+            <field name="model_id" ref="model_res_users_settings"/>
+            <field name="groups" eval="[Command.link(ref('base.group_user'))]"/>
+            <field name="domain_force">[('user_id', '=', user.id)]</field>
+            <field name="perm_read" eval="True"/>
+            <field name="perm_write" eval="True"/>
+            <field name="perm_create" eval="True"/>
+            <field name="perm_unlink" eval="True"/>
+        </record>
+
         <!-- rules for API token -->
         <record id="api_key_public" model="ir.rule">
             <field name="name">Public users can't interact with keys at all</field>