Right now, the 'CRM > Reporting' menu is accessible only to the sales
managers. However, we should let users of all access right levels to
see their reporting while making sure it does not give them access to
data that does not match their rights.
This commit thus changes group applied on 'CRM > Reporting' menu from
'sales_team.group_sale_manager' to 'sales_team.group_sale_salesman' so
that from sales person to manager, everyone is able to the reporting
based on their rights.
For the below sub-menus, record rules already exist, preventing data breach:
- Dashboard (crm_enterprise)
- Leads (crm)
- Pipelines (crm)
- Activities (crm)
However, for data under 'Partnership'(website_crm_partner_assign) and
'Lead Generation Views' sub-menus(crm_iap_lead_website), we introduced
the needed access rights / record rules to ensure basic users can only
see the data they have rights for.
TaskId - 2357311
closesodoo/odoo#64202
Signed-off-by: Thibault Delavallee (tde) <tde@openerp.com>
- Since the wizards now requires ACLs, the access rights
set on the lead forward partner and the lead assignation are
incorrect.
Only the Sales/Administrator are able to use them.
With this commit we introduce the intended behavior where
the sales are able to perform those tasks.
closesodoo/odoo#54568
X-original-commit: 3081ca828e4a7de3861ee5b1fb9600b248c3ea07
Signed-off-by: Toufik Benjaa (tbe) <tbe@odoo.com>
ir.rule are default values but can be customized based on the
company's policy and needs.
This is typically a record that is in noupdate as should be
customization-friendly.
Following changes needing ir.model.access on transient models too.
Remove groups declaration on the action to move it to ir.model.access
when possible.
Rules are strict by default with no unlink access by default and high
priviledge asked. Adaptations may be needed later.
Write access is given as a wizard may need to be modified in case the
action triggers an error and the user has to correct a value
account*: use account.group_account_user for all transient by default
remove account.print.journal relic
stock*: use stock.group_stock_user by default
survey: survey user can send invitations
mail: allow any employee to execute wizards
additional verifications are made to ensure they are executed
only on the documents the user has access to you
give portal access to mail.compose.message as portal still does
some actions like posting messages on the forum
add ir.rule to avoid reading somebody else messages
increase the query count because of undeterminist count
crm: saleman for lead2opp, manager for massmailing
partner manager for actions linked to partners
avoid a write in test_lead_lost
sms: any employee can send sms
mrp: mrp user can execute wizards
give unlink access as making write during do_produce operation
base_import: employees can import files
delivery: stock user can deliver
event_sale: sale user can configure the wizards
event user inherit from sale rights
gamification: employee can give badge
google_service: resolve FIXME
hr: add specific rights
manager can set a plan according to group on button
anyone who can write on an employee can register a departure
hr_expense: set rights based on buttons
hr_holidays: an approver can make a summary report
hr_recruitment: recruiter can refuse a candidate
hr_timesheet: can use the wizard if can create a timesheet
l10n_eu_service: managers can create fiscal positions
mass_mailing: same group as on mass.mailing.list
membership: accountant can create invoice from membership
payment: accountant can create a link
as the source is an account.move
keep the payment.acquirer.onboarding.wizard to system user
only as it is called during company configuration
point_of_sale: PoS manager only can use wizards
never create closing_balance_confirm_wizard records
product_expiry: stock user has rights on stock.picking
product_margin: access from accounting menus
repair: same rules as for above models
sale: set ir.rule for self wizard only
add rule from model introduced in payment to add salesman group
sale_crm: saleman can create a quotation from a lead
sale_coupon: any saleman can generate coupon
add self ir.rule
sale_product_configurator: salesman can select product variants
snailmail: employee can send letters
website: designers can write on website
website_crm_partner_assign: same rule as group on action
website_sale: sale ACL as for payment.acquirer.onboarding.wizard
website_slides: anyone can send invitation
base: base.language.*: allow employee (cf lang_install)
change.password.user: can not read change password wizard of
other users
test.*: no access is needed
Courtesy of Damien Bouvy, William Andre and Antoine Prieëls for review
of acl
Task 2092079
Accounting firms that want to give access to their customers avoiding
mistakes and risks will love this profile that can't do anything
wrong... Maybe as well as companies auditors..?
closesodoo/odoo#39860
Related: odoo/enterprise#6576
Signed-off-by: Quentin De Paoli (qdp) <qdp@openerp.com>
As all information present in this report can be found in the opportunities
dashboard this report can be removed.
This commit is related to task #1878516 and PR #26929 .
Portal user had too many access right on
sensitive documents in this modules. Some
ir.rule were missing, and some model access
were useless.
This commit clean all access right: ir.rule,
ir.model.access and remove useless check in
python code.
Also, some tests were added to check access
rights.
crm.lead model now supports activities. Filters have been added to ease
their management. Mail activities replace the old crm.activity model. All code
related to crm.activity is then removed, including views and custom widget.
Standard activities feature is now used widely in Odoo addons and replace
those custom activities.
A small update is required in website_crm_partner_assign. Now the portal user
can only update or create its own activities aka assigned to him. If he has
an activity assigned to him it is displayed in the opportunity website view.
If not editing the opportunity will create a new activity assigned to him.
Sunil Shrimali