Steps to reproduce:
- for a user, define Timesheets access rights to "User: own timesheets only";
- go to Reporting tab in Timesheets application with this user;
- go to pivot view "By Project" or "By Task".
Issue:
It is possible to see timesheets that do not belong to the user.
Solution:
Add rules which force de domain for the `timesheets.analysis.report` model.
opw-3088745
closesodoo/odoo#108553
X-original-commit: 07c9a3687511c2feaf9b6558da8c7f4d93470e64
Signed-off-by: Xavier Bol (xbo) <xbo@odoo.com>
Signed-off-by: Lefebvre Thomas (thle) <thle@odoo.com>
Before this commit user can directly delete employees even though
employees have timesheets that make employee field in timesheet
black which is not right behavior because in timesheet employee
field is required.
This commit adds a delete wizard for employee delete action
if employees have any timesheet then user cannot delete that
employees without deleting timesheets instead user can archive
that employees.
task-2938632
closesodoo/odoo#98233
Related: odoo/enterprise#30481
Signed-off-by: Xavier Bol (xbo) <xbo@odoo.com>
Remove the security group introduced in odoo/odoo#97988 as it's
redundant with the group_hr_user.
task-2929518
closesodoo/odoo#100127
Signed-off-by: Kevin Baptiste <kba@odoo.com>
The field timesheet_cost defined on hr_employee in hr_timesheet would be
useful in other modules (eg planning and MRP) as well. Therefore with this
commit the field is moved into a separate module upon which
hr_timesheet will have a dependency. In addition this field is renamed
to employee_hourly_wage, which is a more accurate and neutral name for
this field, as it will not only be used in timesheets.
task-2929518
closesodoo/odoo#97988
Related: odoo/enterprise#30359
Related: odoo/upgrade#3853
Signed-off-by: Kevin Baptiste <kba@odoo.com>
Steps to reproduce:
- Install project and timesheet
- Create a project with settings "invited employees only"
- Create a user with administrator project right (and non admin
rights for timesheet)
- Create a task in the new project
- Try to generate a timesheet on the task with the new user (the
user has to not follow the task)
Current behavior:
This generate an access error due to not respecting some rules
Expected behavior:
The timesheet is created
Explanation:
The project admin should be able to handle any timesheet that is
linked to a project to do so we add its groupto the rule that gives
access to the model analytic.model_account_analytic_line if there
is a project_id.
opw-2861042
closesodoo/odoo#94102
X-original-commit: 70a0ad280e0c8a62f24d6943be082298fa98e443
Signed-off-by: Laurent Stukkens (ltu) <ltu@odoo.com>
A new report was created for timesheets, also introducing new measures regarding
the (non-)billable time (percentage) and the timesheets revenues/costs. Some general
improvements were furthermore introduced in the timesheet apps.
See task-2783955
closesodoo/odoo#88072
Related: odoo/upgrade#3509
Related: odoo/enterprise#25922
Signed-off-by: Laurent Stukkens (ltu) <ltu@odoo.com>
Currently the timer does not exist in hr_timesheet so project.task.create.timesheet
wizard is useless in hr_timesheet and not used anywhere in hr_timesheet.
so in this commit removed project.task.create.timesheet wizard
from hr_timesheet.
task-2710154
closesodoo/odoo#81197
Related: odoo/enterprise#22819
Related: odoo/upgrade#3101
Signed-off-by: Laurent Stukkens (ltu) <ltu@odoo.com>
Expected behavior :
Project manager can change task's project of any task including timesheets
Current behavior :
When Project manager with `Timesheets : See own timesheets` permission is updating task's project, an Access Error exception is raised `Only a Timesheets Approver or Manager is allowed to modify a validated entry.`
Steps to reproduce :
*Use demo data to make steps easier*
- Install Project and Timesheets
- Go to Project and select one
- Select any Task
- Edit it and try to change the Project
Reason :
When a user is a project administrator, he can still have basic permissions in Timesheets (`Timesheets : See own timesheets`), which prevents him from modifying the task's project if the task has some validated timesheet
OPW-2646233
closesodoo/odoo#80973
X-original-commit: 41907c6722da5b4777cc3b8065f4057b0a5f0801
Signed-off-by: Nicolas Lempereur (nle) <nle@odoo.com>
Signed-off-by: Simon Goffin <sig@odoo.com>
Signed-off-by: Claude Thibault (thcl) <thcl@odoo.com>
before this commit:
The approver can access all timesheets which is not coherent.
after this commit:
improved the labelling of the timesheet app's roles, modified the menu according
to role of User.Aprrover now can access his own timesheets only by click only
available option 'My timesheets'.
TaskID - 2531321
closesodoo/odoo#74242
Related: odoo/enterprise#19858
Signed-off-by: Yannick Tivisse (yti) <yti@odoo.com>
Before this commit, the project sharing feature is enabled by default
when the Project app is installed but the user could never use the
feature and thus we add more access rights to portal user for nothing.
To avoid this, this commit removes by default all additional access
rights given by project sharing feature and adds this access rights only
when a collaborator is added.
If the user removes all collaborators for all projects then we need
to disable the feature. That is, we will remove the access rights and
ir.rule records added.
So, the feature will not really disable but we remove the additionnal
access rights and ir.rule records added with this feature.
task-2379518
closes#73341
This reverts commit fc7778f8c512202dc3361d6b87be8c28b299c3c8 because of
a change in the spec.
The access mode are removed and replaced by this access mode for portal
user:
- read: the user goes to the classic portal view
- edit: the user is added as collaborator of the shared project and can
access to project sharing views.
To do this, the portal share is inherited by the project share wizard.
This new wizard can be open to share in readonly and open to share in
edit mode via 2 buttons in the form view of the shared project.
A new stat button is added to form view of project to see the
collaborators of this project. That is, the ones can access to the
project sharing views. The project manager will can remove or also add
new collaborators via the views in this stat button.
task-2379518
closes#73341
Before this commit, the portal could not access to timesheets of the
task in project sharing views.
This commit adds the access to give him the read access to the
timesheets in the tasks of the shared project.
Moreover, this commit adds a `ir.rule` to limit the access to this
portal user and we keep the default values to True on all perms,
that way if someone modifies the ACL to give C/W/U permissions,
this rule will still give some protection.
task-2379518
closes#73341
Co-authored: Yannick Tivisse (yti) <yti@odoo.com>
This reverts commit odoo/odoo@7059b17.
This commit translates tests introduced in this reverted commit to be
aligned with the current workflow.
This commit reverts functionality or business logic linked to the
reverted commit :
- odoo/odoo#47248 : You no longer have to be an allowed user to see the
timesheets but only a message partner.
- odoo/odoo#49021 : We no longer deal with allowed_user_ids or
allowed_portal_user_ids
- odoo/odoo@f2a1a00 : We no longer deal with the allowed users lists.
This commit removes the button project_privacy_visibility for functional
reasons.
Closes: #65367
task-2439329
Related: odoo/upgrade#2128
Related: odoo/enterprise#16067
Signed-off-by: Yannick Tivisse (yti) <yti@odoo.com>
Back2Basics of the timesheet module. Add helpers/dummy data to improve
the onboarding of the module.
Rename some roles/menus.
Add a QR Code client action when clicking on the timesheet app icons in
settings to allow users to directly download the app on their phone.
closesodoo/odoo#55565
Taskid: 2303955
Related: odoo/enterprise#12273
Signed-off-by: Yannick Tivisse (yti) <yti@odoo.com>
Purpose
=======
The current kanban view is messy. It is difficult to identify which
apps are installed or not. The user can completely miss a module
that might have interested him. A search panel would make things way
more readable.
closesodoo/odoo#44401
Taskid: 2181557
Related: odoo/enterprise#8144
Related: odoo/upgrade#879
Signed-off-by: Yannick Tivisse (yti) <yti@odoo.com>
Following changes needing ir.model.access on transient models too.
Remove groups declaration on the action to move it to ir.model.access
when possible.
Rules are strict by default with no unlink access by default and high
priviledge asked. Adaptations may be needed later.
Write access is given as a wizard may need to be modified in case the
action triggers an error and the user has to correct a value
account*: use account.group_account_user for all transient by default
remove account.print.journal relic
stock*: use stock.group_stock_user by default
survey: survey user can send invitations
mail: allow any employee to execute wizards
additional verifications are made to ensure they are executed
only on the documents the user has access to you
give portal access to mail.compose.message as portal still does
some actions like posting messages on the forum
add ir.rule to avoid reading somebody else messages
increase the query count because of undeterminist count
crm: saleman for lead2opp, manager for massmailing
partner manager for actions linked to partners
avoid a write in test_lead_lost
sms: any employee can send sms
mrp: mrp user can execute wizards
give unlink access as making write during do_produce operation
base_import: employees can import files
delivery: stock user can deliver
event_sale: sale user can configure the wizards
event user inherit from sale rights
gamification: employee can give badge
google_service: resolve FIXME
hr: add specific rights
manager can set a plan according to group on button
anyone who can write on an employee can register a departure
hr_expense: set rights based on buttons
hr_holidays: an approver can make a summary report
hr_recruitment: recruiter can refuse a candidate
hr_timesheet: can use the wizard if can create a timesheet
l10n_eu_service: managers can create fiscal positions
mass_mailing: same group as on mass.mailing.list
membership: accountant can create invoice from membership
payment: accountant can create a link
as the source is an account.move
keep the payment.acquirer.onboarding.wizard to system user
only as it is called during company configuration
point_of_sale: PoS manager only can use wizards
never create closing_balance_confirm_wizard records
product_expiry: stock user has rights on stock.picking
product_margin: access from accounting menus
repair: same rules as for above models
sale: set ir.rule for self wizard only
add rule from model introduced in payment to add salesman group
sale_crm: saleman can create a quotation from a lead
sale_coupon: any saleman can generate coupon
add self ir.rule
sale_product_configurator: salesman can select product variants
snailmail: employee can send letters
website: designers can write on website
website_crm_partner_assign: same rule as group on action
website_sale: sale ACL as for payment.acquirer.onboarding.wizard
website_slides: anyone can send invitation
base: base.language.*: allow employee (cf lang_install)
change.password.user: can not read change password wizard of
other users
test.*: no access is needed
Courtesy of Damien Bouvy, William Andre and Antoine Prieëls for review
of acl
=======
Purpose
=======
Currently for a user to be allowed to see a private project they must follow the
project. This means that they will be added as a follower of all new tasks in the
project which causes them to receive 1000000 notifications, especially if there are a
lot of tasks in a project.
==============
Specifications
==============
1) Add an Employee m2m field on project next to 'Invited Employees'
- only visible if the 'Invited Employees' option is selected
- the project should only be visible to employees selected there (regardless if they
are followers or not)
2) Add an Employee m2m field on tasks below the 'Email cc' one in debug mode
- only visible if the 'Invited Employees' option is selected on the related project
- should be pre-filled with what is set on the project
- the task should be visible to employees selected there (regardless if they are
followers or not)
3) Add a Portal users m2m field on project next to 'Portal users and all employees'
- only visible if the 'Portal users and all employees' option is selected
- the project should only be visible to portal users selected there (regardless if
they are followers or not)
- rename the option into 'Invited portal users and all employees'
4) Add a Portal users m2m field on tasks below the 'Email cc' one in debug mode
- only visible if the 'Portal users and all employees' option is selected
- should be pre-filled with what is set on the project
- the task should be visible to portal users selected there (regardless if they are
followers or not)
5) Following a project/task should not grant the user/employee the ability to see the
project/task
Task 2031527
closesodoo/odoo#40505
Signed-off-by: Yannick Tivisse (yti) <yti@odoo.com>
TaskID: 2088586
Timer in the list and kanban views :
----------------------------------
In kanban and list views, It's possible to update the 'unit_amount'
field with a timer. The user can easily launch the timer in these views
for one of his timesheets.
One timesheet can be launched at the same time, when the user start a
timer for a timesheet and start another timer for another timesheet, the
first timer stop and the new timer start.
The timer is usable only if the encoding unit is 'Hours' and the
timesheet is not validated. To do this : a new computed field 'display_timer'
is created in account.analytic.line, this field is set to True is the
encoding unit is 'Hours'. With this field, we can easily hide and display
the timer in different views.
The user can only use the timer for his timesheets. Because the user
with the access rights to see all timesheets might launch and/or stop a timer of a
timesheet of other user. That is the timer must be accessed only in 'My Timesheets' menu.
Add pivot view for 'All timesheets' menu.
Creation a timer_mixin :
----------------------
With this timer mixin, we can have a generic timer to use in other
models that they need to use a timer like account.analytic.line and
project.task models
The timer in account.analytic.line model has changed to use the timer
mixin.
Specific behaviour of the timer :
-------------------------------
When the user use the timer and the minutes spent with the timer is less
than 1 minute, we don't add in unit_amount of timesheet. If the
unit_amount is equals to 0 and minutes spent of timer is less than 0.
Then the timesheet created by the timer is deleted because it is useless to
have a timesheet with unit_amount set on 0.
Misc :
----
Add some styles for the timer button and for the 'unit_amount' field when the
timer is running.
remove duplicated fields in tree view (record
id='timesheet_view_tree_user')
TaskID: 2088586
The low level access right is now "See my timesheets".
This access disallow to a user to view and manage the timesheets of others users.
When the visibility of a project is set on "Invited employees",
the users with the access rules : 'See my timesheet' and
'See all timesheets' can show the timesheets, if these users
follow the project.
Purpose of the commit is to clean the current portal right of
timesheet(analytic account line) and analytic account(no more ir.rule).
the idea is to remove ir.rule since the domain will be difficult with ir.rule
extension mecanism. Moreover, as this is "technical" data, we will use 'sudo' controller.
as we don't want to customize what is shown in portal.
End user is free to create its own ir.rule to connect odoo in xmlrpc
he will be the only responsible for that.
task-1932488
When we remove the inheritS between project and analytic account, we move the
analytic_accound_id field in timesheet because it was the only use case for
a project to be linked to an analytic account.
This commit prepares new cost origin for a project (other that timesheet).
Register costs on project will required an analytic account to keep analytic
costs tracking. The analytic account management is now moved to project, like
it was in 10.0, but without the inheritS.
Task-1911581
Purpose
=======
Access group terminology is missleading. Yous have to be manager to administrate
an application. This task consists to rename groups to be understandable for everyone.
Groups should be reorganised on the users form to be more explicit.
Specification
=============
1/ Rename 'Manager' to 'Administrator' in users groups.
2/ Define a hierarchy on access groups by using the category_id in the manifests
A category 'Operations/Project' will create a category Project with a parent
category 'Operations', and something smart is already developed (in modules/db.py)
to avoid duplicating categories.
3/ Add a group in expenses to be able to approve expenses reports for my team.
4/ Add a group in timesheets to be able to approve timesheets for my team.
5/ Remove partially the useless crap in ir_module_category_data.xml
6/ Sort access rights groups on users form according to its parent category
closesodoo/odoo#29362
Signed-off-by: "Yannick Tivisse (yti)" <yti@odoo.com>
For historical reason, project depended on product. Probably to use
UoM. Now, UoM is extracted in 'uom' module, and project does not
use UoM anymore (only with timesheet). Removing the 'product'
dependency requires to make hr_timesheet depending of uom, since
this one really use UoM mecanism.
Task #39079
This commit removes the inheritS between account.analytic.account and
project.project. This means :
- When a project is created, an analytic account is not necessarily
genareted
- project has now its own name, company_id and partner_id fields
- an analytic account can be linked to several project
- project module does not depend anymore of analytic, but hr_timesheet
does.
This change implied
- an analytic account is required on project to timesheet on
its tasks. So, when checking 'allow_timsheets', if an AA is not
provided at project creation, an AA will be generated.
- to timesheet on project, an active AA is required. We don't want
timesheeting on project linked to unused AA to avoid bad analytic
entries.
This prepare the fact a sale order can create multiple project, sharing
the same analytic account (the one from the SO).
Moves UoM models, test and data to a new addon in
order to be able to use uom without product.
A simple example is be to be able to use UoM for
timesheets.
This commit only move code, and adapt xml ids
without chaging any feature or functionnal
behavior.
Note: 'product' module now depends on new
'uom' module.
- Create an invoice with an analytic account on a line
- Validate it
A read access error occurs.
The rule is too restrictive: reading should be allowed for users.
opw-805533
Regular employees are added to the timesheets user group
so they can access to the Timesheets modules.
Requiring timesheets users to be HR Officer would almost mean to
require all employees to be HR officer, which is not the case.
The above is the result of the revision
a806f96fa2
Before, the timesheets user group was the
timesheets officer group, and it was the only
group for the module timesheets. There
were no timesheets manager or user group.
This group implied the HR Officer groups,
but it made sense as it was the Timesheets
Officer group.
Now that it is the timesheets user group,
it doesn't make sense to imply
the HR Officer group.
Purpose of timesheet module is to track user time. This commit applies
various improvements and tweaking to better reflect this purpose.
This commit provides some UI improvements
* improve views : user_id field is not displayed on 'My Timesheet'
action, since it will always be the same user;
* simplify menus : 'My timesheet' only for current user's timesheets
and 'All timesheet' for everyone's. The latter one allows creating
timesheets for someone else, if you have the required access rights;
* add calendar views for timesheets
* some filters are added to ease time-based filtering of timesheets
This commit also reorganizes user groups. Groups are now
* new 'timesheet user' group (different from base.group_employee). Users
can record their own timesheet. New access rights were added to perform
the same operations as before.
* 'timesheet manager' (hr_timesheet.group_manager). Users can record
timesheets for other users, access to settings and reporting tools.
PURPOSE
=======
For each and every Hr application there should be one user category (One app = one category).
SPECIFICATION
=============
HR remains as it is : Employee, Officer, Manager
Each Application should have 2 access rights: User and Manager. Example for Recruitment:
- The user has access to the recruitment process
- The manager has access to the job position configuration
Each Application should grant the employee user access right (Namely the 'HR Officer')
Several modules defines records with the external ID `base.foo_bar` while it is
created inside this module (typically menus and groups).
While there is no technical reasons to do so but this may introduce issues:
- these records will not be deleted during uninstall
- if a language is loaded before the installation of the module, it won't be
translated
The uninstallation will only remove the records with an external id linked to
this module (these would only be removed when removing base).
Installing a language before the module will drop the translations not linked
to an existing external id (as it can not be resolved).
This commit correct all the external ids tagged as from base or other incorrect
modules.
* removed hr.timesheet.report as it's mostly redundant with regular
views on analytic lines
* moved "detailed activities" to reporting, renamed it, added a pivot
view
* redirected timesheet link from HR dashboard to the detailed activities
action
- added department_id to analytic lines as that link is filtered by
department
- fixed bug in kanban view: button context wasn't evaluated in the
correct context
- Hide account_id field and add a required project_id field on timesheet entries
- Remove is_timesheet field: as project_id is only required for timesheet entries and not for other analytic lines, it can be used to determine wether a line is a timeheet entry or not.
- Remove project_timesheet module as all its functionalities are moved to hr_timesheet
- Replace timesheets on contract option on products by timesheets on project
- Small fixes and improvements in timesheets and projects views and groups
Major changes:
- No use of UoS anymore
- No journal since invoicing is managed in Sale
- No invoicing from timesheet
Reason: complete rewrite of the Sale module.
Responsible: fp, dbo, nim
hr.timesheet.report was moved from hr_timesheet_sheet to hr_timesheet but not the ir.model.access
Avoid warning "The model hr.timesheet.report has no access rules, consider adding one."
Fixes#3319
ir.rule records are in noupdate data blocks to let the admin
alter them without fear of them being reset at next update.
Other records such as groups are in normal mode, so they
can be updated whenever necessary
bzr revid: odo@openerp.com-20121218232001-t425t4hi7qbmsip2
Thomas Lefebvre (thle)