From d80b0221952d6d2d231a75d9f705b8276554233f Mon Sep 17 00:00:00 2001
From: Olivier Dony <odo@openerp.com>
Date: Tue, 22 Nov 2011 14:11:10 +0100
Subject: [PATCH] [FIX] ir.ui.view.custom: fix access rights and rules

Anyone should have full access to their own
ir.ui.view.custom records, as this is the way
to customize dashboards. This is done with
full access for everybody + an access rule
that only grants this access on your own
records.

bzr revid: odo@openerp.com-20111122131110-awawg4dhgsxb6xrc
---
 .../addons/base/security/base_security.xml    | 22 +++++++++++--------
 .../addons/base/security/ir.model.access.csv  |  3 +--
 2 files changed, 14 insertions(+), 11 deletions(-)

diff --git a/openerp/addons/base/security/base_security.xml b/openerp/addons/base/security/base_security.xml
index 65696210687..cb749eb3c66 100644
--- a/openerp/addons/base/security/base_security.xml
+++ b/openerp/addons/base/security/base_security.xml
@@ -49,14 +49,12 @@
         <record model="ir.rule" id="res_widget_user_rule">
             <field name="name">res.widget.user rule</field>
             <field name="model_id" ref="model_res_widget_user"/>
-            <field name="global" eval="True"/>
             <field name="domain_force">['|', ('user_id','=',user.id),('user_id','=',False)]</field>
         </record>
 
         <record model="ir.rule" id="res_partner_rule">
             <field name="name">res.partner company</field>
             <field name="model_id" ref="model_res_partner"/>
-            <field name="global" eval="True"/>
             <!-- Show partners from ancestors and descendants companies (or company-less), this is usually a better
                  default for multicompany setups. -->
             <field name="domain_force">['|','|',('company_id.child_ids','child_of',[user.company_id.id]),('company_id','child_of',[user.company_id.id]),('company_id','=',False)]</field>
@@ -65,16 +63,22 @@
         <record model="ir.rule" id="multi_company_default_rule">
             <field name="name">Multi_company_default company</field>
             <field name="model_id" ref="model_multi_company_default"/>
-            <field name="global" eval="True"/>
             <field name="domain_force">[('company_id','child_of',[user.company_id.id])]</field>
         </record>
 
-    <record model="ir.rule" id="ir_values_default_rule">
-        <field name="name">Defaults: alter personal values only</field>
-        <field name="model_id" ref="model_ir_values"/>
-        <field name="domain_force">[('key','=','default'),('user_id','=',user.id)]</field>
-        <field name="perm_read" eval="False"/>
-    </record>
+        <record model="ir.rule" id="ir_values_default_rule">
+            <field name="name">Defaults: alter personal values only</field>
+            <field name="model_id" ref="model_ir_values"/>
+            <field name="domain_force">[('key','=','default'),('user_id','=',user.id)]</field>
+            <field name="perm_read" eval="False"/>
+        </record>
+
+        <!-- Used for dashboard customizations, users should only be able to edit their own dashboards -->
+        <record model="ir.rule" id="ir_ui_view_custom_personal">
+            <field name="name">ir.ui.view_custom rule</field>
+            <field name="model_id" ref="model_ir_ui_view_custom"/>
+            <field name="domain_force">[('user_id','=',user.id)]</field>
+        </record>
 
     </data>
 </openerp>
diff --git a/openerp/addons/base/security/ir.model.access.csv b/openerp/addons/base/security/ir.model.access.csv
index 3820c48ae9a..59ebafb2f99 100644
--- a/openerp/addons/base/security/ir.model.access.csv
+++ b/openerp/addons/base/security/ir.model.access.csv
@@ -35,8 +35,7 @@
 "access_ir_ui_menu_group_system","ir_ui_menu group_system","model_ir_ui_menu","group_system",1,1,1,1
 "access_ir_ui_view_group_user","ir_ui_view group_user","model_ir_ui_view",,1,0,0,0
 "access_ir_ui_view_group_system","ir_ui_view group_system","model_ir_ui_view","group_system",1,1,1,1
-"access_ir_ui_view_custom_group_user","ir_ui_view_custom_group_user","model_ir_ui_view_custom",,1,0,0,0
-"access_ir_ui_view_custom_group_system","ir_ui_view_custom_group_system","model_ir_ui_view_custom","group_system",1,1,1,1
+"access_ir_ui_view_custom_group_user","ir_ui_view_custom_group_user","model_ir_ui_view_custom",,1,1,1,1
 "access_ir_ui_view_sc_group_user","ir_ui_view_sc group_user","model_ir_ui_view_sc",,1,1,1,1
 "access_ir_values_group_all","ir_values group_all","model_ir_values",,1,1,1,1
 "access_res_company_group_erp_manager","res_company group_erp_manager","model_res_company","group_erp_manager",1,1,1,1