From f9272264c155ecd407aec4f3fe1cb8eb051bc50a Mon Sep 17 00:00:00 2001
From: Denis Ledoux <dle@odoo.com>
Date: Wed, 1 Feb 2017 17:30:49 +0100
Subject: [PATCH] [FIX] account: invoice report multi-company security

This record rule added in the below revision:
1950fc4216122840767324beaf15c7c4eeb40bfd

has been removed for an unknown reason during the account refactoring
c04065abd8f62c9a211c8fa824f5eecf68e61b73

Without this rule, a user can see invoices from other companies
through the invoices analysis.

opw-705718
---
 addons/account/security/account_security.xml | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/addons/account/security/account_security.xml b/addons/account/security/account_security.xml
index 5547e561cac..4c28f887df5 100644
--- a/addons/account/security/account_security.xml
+++ b/addons/account/security/account_security.xml
@@ -71,6 +71,13 @@
         <field name="domain_force">['|',('company_id','=',False),('company_id','child_of',[user.company_id.id])]</field>
     </record>
 
+    <record id="invoice_analysis_comp_rule" model="ir.rule">
+        <field name="name">Invoice Analysis multi-company</field>
+        <field name="model_id" ref="model_account_invoice_report"/>
+        <field name="global" eval="True"/>
+        <field name="domain_force">['|',('company_id','=',False),('company_id','child_of',[user.company_id.id])]</field>
+    </record>
+
     <record id="account_fiscal_position_comp_rule" model="ir.rule">
         <field name="name">Account fiscal Mapping company rule</field>
         <field name="model_id" ref="model_account_fiscal_position"/>