From e7f22391ef62ae992d5193f09cd37cd4373428b6 Mon Sep 17 00:00:00 2001
From: Jairo Llopis <jairo.llopis@tecnativa.com>
Date: Wed, 9 Jun 2021 06:35:13 +0000
Subject: [PATCH] [FIX] sale: do not grant access to purchase invoices by
 default

Sales people should only access customer invoices by default.

Notice that [the equivalent rule in the `purchase` module][1] makes more sense.

[1] https://github.com/odoo/odoo/blob/e2247a860d3d4931d641928a6313bef4649e0edf/addons/purchase/security/purchase_security.xml#L62

@Tecnativa TT30228

closes odoo/odoo#72002

X-original-commit: dde96d6601d6b63762c6a57a8e0260eabad81289
Signed-off-by: Laurent Smet <smetl@users.noreply.github.com>
---
 addons/sale/security/sale_security.xml | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/addons/sale/security/sale_security.xml b/addons/sale/security/sale_security.xml
index d9f22294ed6..66572c9ff99 100644
--- a/addons/sale/security/sale_security.xml
+++ b/addons/sale/security/sale_security.xml
@@ -156,42 +156,42 @@
     <record id="account_invoice_rule_see_personal" model="ir.rule">
         <field name="name">Personal Invoices</field>
         <field name="model_id" ref="model_account_move"/>
-        <field name="domain_force">[('move_type', 'in', ('out_invoice', 'out_refund', 'in_invoice', 'in_refund')), '|', ('invoice_user_id', '=', user.id), ('invoice_user_id', '=', False)]</field>
+        <field name="domain_force">[('move_type', 'in', ('out_invoice', 'out_refund')), '|', ('invoice_user_id', '=', user.id), ('invoice_user_id', '=', False)]</field>
         <field name="groups" eval="[(4, ref('sales_team.group_sale_salesman'))]"/>
     </record>
 
     <record id="account_invoice_rule_see_all" model="ir.rule">
         <field name="name">All Invoices</field>
         <field name="model_id" ref="model_account_move"/>
-        <field name="domain_force">[('move_type', 'in', ('out_invoice', 'out_refund', 'in_invoice', 'in_refund'))]</field>
+        <field name="domain_force">[('move_type', 'in', ('out_invoice', 'out_refund'))]</field>
         <field name="groups" eval="[(4, ref('sales_team.group_sale_salesman_all_leads'))]"/>
     </record>
 
     <record id="account_invoice_line_rule_see_personal" model="ir.rule">
         <field name="name">Personal Invoice Lines</field>
         <field name="model_id" ref="model_account_move_line"/>
-        <field name="domain_force">[('move_id.move_type', 'in', ('out_invoice', 'out_refund', 'in_invoice', 'in_refund')), '|', ('move_id.invoice_user_id', '=', user.id), ('move_id.invoice_user_id', '=', False)]</field>
+        <field name="domain_force">[('move_id.move_type', 'in', ('out_invoice', 'out_refund')), '|', ('move_id.invoice_user_id', '=', user.id), ('move_id.invoice_user_id', '=', False)]</field>
         <field name="groups" eval="[(4, ref('sales_team.group_sale_salesman'))]"/>
     </record>
 
     <record id="account_invoice_line_rule_see_all" model="ir.rule">
         <field name="name">All Invoice Lines</field>
         <field name="model_id" ref="model_account_move_line"/>
-        <field name="domain_force">[('move_id.move_type', 'in', ('out_invoice', 'out_refund', 'in_invoice', 'in_refund'))]</field>
+        <field name="domain_force">[('move_id.move_type', 'in', ('out_invoice', 'out_refund'))]</field>
         <field name="groups" eval="[(4, ref('sales_team.group_sale_salesman_all_leads'))]"/>
     </record>
 
     <record id="account_invoice_send_rule_see_personal" model="ir.rule">
         <field name="name">Personal Invoice Send and Print</field>
         <field name="model_id" ref="account.model_account_invoice_send"/>
-        <field name="domain_force">[('invoice_ids.move_type', 'in', ('out_invoice', 'out_refund', 'in_invoice', 'in_refund')), '|', ('invoice_ids.invoice_user_id', '=', user.id), ('invoice_ids.invoice_user_id', '=', False)]</field>
+        <field name="domain_force">[('invoice_ids.move_type', 'in', ('out_invoice', 'out_refund')), '|', ('invoice_ids.invoice_user_id', '=', user.id), ('invoice_ids.invoice_user_id', '=', False)]</field>
         <field name="groups" eval="[(4, ref('sales_team.group_sale_salesman'))]"/>
     </record>
 
     <record id="account_invoice_send_rule_see_all" model="ir.rule">
         <field name="name">All Invoice Send and Print</field>
         <field name="model_id" ref="account.model_account_invoice_send"/>
-        <field name="domain_force">[('invoice_ids.move_type', 'in', ('out_invoice', 'out_refund', 'in_invoice', 'in_refund'))]</field>
+        <field name="domain_force">[('invoice_ids.move_type', 'in', ('out_invoice', 'out_refund'))]</field>
         <field name="groups" eval="[(4, ref('sales_team.group_sale_salesman_all_leads'))]"/>
     </record>