pengyuthon/odoo_source
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[FIX] account: invoice report multi-company security

Browse Source 
This record rule added in the below revision:
1950fc4216

has been removed for an unknown reason during the account refactoring
c04065abd8

Without this rule, a user can see invoices from other companies
through the invoices analysis.

opw-705718
This commit is contained in:
Denis Ledoux
2017-02-01 17:32:40 +01:00
parent 6d1df94614
commit f9272264c1
1 changed files with 7 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
addons/account/security/account_security.xml
+7
View File
@@ -71,6 +71,13 @@
<field name="domain_force">['|',('company_id','=',False),('company_id','child_of',[user.company_id.id])]</field>
</record>
<record id="invoice_analysis_comp_rule" model="ir.rule">
<field name="name">Invoice Analysis multi-company</field>
<field name="model_id" ref="model_account_invoice_report"/>
<field name="global" eval="True"/>
<field name="domain_force">['|',('company_id','=',False),('company_id','child_of',[user.company_id.id])]</field>
</record>
<record id="account_fiscal_position_comp_rule" model="ir.rule">
<field name="name">Account fiscal Mapping company rule</field>
<field name="model_id" ref="model_account_fiscal_position"/>