diff --git a/odoo/addons/base/security/base_groups.xml b/odoo/addons/base/security/base_groups.xml
index 73b2580a54b..cf53bcda031 100644
--- a/odoo/addons/base/security/base_groups.xml
+++ b/odoo/addons/base/security/base_groups.xml
@@ -9,6 +9,7 @@
-->
Access Rights
+
diff --git a/odoo/addons/base/tests/test_res_config.py b/odoo/addons/base/tests/test_res_config.py
index 552d8759715..fe8cb885dd5 100644
--- a/odoo/addons/base/tests/test_res_config.py
+++ b/odoo/addons/base/tests/test_res_config.py
@@ -1,10 +1,11 @@
# -*- coding: utf-8 -*-
# Part of Odoo. See LICENSE file for full copyright and licensing details.
+from collections import defaultdict
import logging
-from odoo import exceptions
-from odoo.tests.common import TransactionCase, tagged
+from odoo import exceptions, Command
+from odoo.tests.common import Form, TransactionCase, tagged
_logger = logging.getLogger(__name__)
@@ -97,3 +98,86 @@ class TestResConfigExecute(TransactionCase):
for config_settings in all_config_settings:
_logger.info("Testing %s" % (config_settings.name))
self.env[config_settings.name].create({}).execute()
+
+ def test_settings_access(self):
+ """Check that settings user are able to open & save settings
+
+ Also check that user with settings rights + any one of the groups restricting
+ a conditional view inheritance of res.config.settings view is also able to
+ open & save the settings (considering the added conditional content)
+ """
+ ResUsers = self.env['res.users']
+ group_system = self.env.ref('base.group_system')
+ self.settings_view = self.env.ref('base.res_config_settings_view_form')
+ settings_only_user = ResUsers.create({
+ 'name': 'Sleepy Joe',
+ 'login': 'sleepy',
+ 'groups_id': [Command.link(group_system.id)],
+ })
+
+ _logger.info("Testing settings access for group %s", group_system.full_name)
+ forbidden_models = self._test_user_settings_fields_access(settings_only_user)
+ self._test_user_settings_view_save(settings_only_user)
+
+ for model in forbidden_models:
+ _logger.warning("Settings user doesn\'t have read access to the model %s", model)
+
+ settings_view_conditional_groups = self.env['ir.ui.view'].search([
+ ('model', '=', 'res.config.settings'),
+ ]).groups_id
+
+ for group in settings_view_conditional_groups:
+ group_name = group.full_name
+ _logger.info("Testing settings access for group %s", group_name)
+ create_values = {
+ 'name': f'Test {group_name}',
+ 'login': group_name,
+ 'groups_id': [Command.link(group_system.id), Command.link(group.id)]
+ }
+ user = ResUsers.create(create_values)
+ self._test_user_settings_view_save(user)
+ forbidden_models_fields = self._test_user_settings_fields_access(user)
+
+ for model, fields in forbidden_models_fields.items():
+ _logger.warning(
+ "Settings + %s user doesn\'t have read access to the model %s"
+ "linked to settings records by the field(s) %s",
+ group_name, model, ", ".join(str(field) for field in fields)
+ )
+
+ def _test_user_settings_fields_access(self, user):
+ """Verify that settings user are able to create & save settings."""
+ settings = self.env['res.config.settings'].with_user(user).create({})
+
+ # Save the settings
+ settings.set_values()
+
+ # Check user has access to all models of relational fields in view
+ # because the webclient makes a name_get request for all specified records
+ # even if they are not shown to the user.
+ settings_view_arch = self.settings_view.with_user(user)._get_combined_arch()
+ seen_fields = set()
+ for node in settings_view_arch.iterdescendants(tag='field'):
+ seen_fields.add(node.get('name'))
+
+ models_to_check = defaultdict(set)
+ for field_name in seen_fields:
+ field = settings._fields[field_name]
+ if field.relational:
+ models_to_check[field.comodel_name].add(field)
+
+ forbidden_models_fields = defaultdict(set)
+ for model in models_to_check:
+ has_read_access = self.env[model].with_user(user).check_access_rights(
+ 'read', raise_exception=False)
+ if not has_read_access:
+ forbidden_models_fields[model] = models_to_check[model]
+
+ return forbidden_models_fields
+
+ def _test_user_settings_view_save(self, user):
+ """Verify that settings user are able to save the settings form."""
+ ResConfigSettings = self.env['res.config.settings'].with_user(user)
+
+ settings_form = Form(ResConfigSettings)
+ settings_form.save()
diff --git a/odoo/addons/test_action_bindings/tests/test_bindings.py b/odoo/addons/test_action_bindings/tests/test_bindings.py
index cb9ba4561ed..e7bdcc66f0b 100644
--- a/odoo/addons/test_action_bindings/tests/test_bindings.py
+++ b/odoo/addons/test_action_bindings/tests/test_bindings.py
@@ -33,7 +33,7 @@ class TestActionBindings(common.TransactionCase):
)
# add a group on an action, and check that it is not returned
- group = self.env.ref('base.group_user')
+ group = self.env.ref('base.group_system')
action2.groups_id += group
self.env.user.groups_id -= group