Commit Graph
14 Commits
Author SHA1 Message Date
Raphael Collet 4a18d5744e [FIX] base: restrict read access to ir.model and ir.model.fields to employees 2017-01-20 10:05:10 +01:00
Raphael Collet 3649b7f359 [FIX] base: access rights of ir.model and ir.model.fields
This partially reverts commits 5d746d0ac6 and
73de86c768.

The tightening of access rights was too strong: regular users need to be able
to read models and fields (to create an email templace, for instance.)

[FIX] ir_values: in `get_actions`, exclude field `code`
2017-01-17 16:15:26 +01:00
Raphael Collet 172a767e5f [IMP] base: tighten ir.rule access rights
The computed field `domain` was formerly read as the current user to evaluate
the rule's domain for the current user.  As we restrict the access of `ir.rule`
to advanced users only, the computed field has no purpose anymore.
2017-01-03 16:52:50 +01:00
Raphael Collet 6453e4eb23 [IMP] base: tighten ir.model.data access rights 2017-01-03 16:52:50 +01:00
Raphael Collet 34c661111b [IMP] base, *: tighten ir.model.access access rights
In `website_crm_partner_assign`, remove duplicate ACLs and reorganize files.
2017-01-03 16:52:50 +01:00
Raphael Collet 4f230b2180 [IMP] base: tighten ir.model.relation access rights 2017-01-03 16:52:50 +01:00
Raphael Collet 73de86c768 [IMP] base: tighten ir.model.fields access rights 2017-01-03 16:52:49 +01:00
Raphael Collet 18f4711dce [IMP] base: tighten ir.model.constraint access rights 2017-01-03 16:52:49 +01:00
Raphael Collet 5d746d0ac6 [IMP] base, *: tighten ir.model access rights
Remove unrestricted "read" access.  To make code internally using `ir.model`
work, add a private method `_get` on `ir.model` to retrieve the record
corresponding to a model name, without access rights issue.

Change signature of method `get_authorized_fields` to make it use a model name
instead of a model id.  This removes the necessity of a search on `ir.model`.
2017-01-03 16:52:49 +01:00
Raphael Collet 1abd543f14 [IMP] base: tighten ir.filters access rights
Remove "full access" for all users, and add it to specific groups.
2017-01-03 16:52:49 +01:00
Raphael Collet d0ca2d115e [REF] ir_config_parameter: remove group_ids and simplify
Add `sudo()` to call `get_param` where necessary, and make the web client use a
controller instead of directly accessing parameters.
2017-01-03 16:52:49 +01:00
Jérome Maes 13f84b9aca [REM] *: remove ir.needaction mixin
ir.needaction_mixin is not used anymore by the webclient.
From 9.0, the concept has changed: this feature is now
available in mail module, with the mail.thread mixin,
and message_neeadction field.

Remove all code handeling needaction bullet and
counter on ir.ui.menu, knowing that since 9.0
webclient does not display the counter anymore.

This code was, thus, useless and some RPC calls
were done for nothing, and adapt accounting
reconcialiation widget.
2016-12-05 11:30:03 +01:00
Yannick Tivisse 98cb4719db [REM] workflow: Remove workflow engine, documentation and tests 2016-11-23 11:52:39 +01:00
Raphael Collet 9e64f9f951 [REF] openerp: move openerp to odoo 2016-09-02 17:28:12 +02:00