Víctor Martínez
0b8010a4e6
There is a ir.model.access rule that allows `hr_expense_team_approver` group members to read account moves and account move lines. Another existing rule forces the domain to only read account move lines that have an associated expense_id. This rule however is not repeated for account moves, and thus an `hr_expense_team_approver` group user is able to access unrelated Customer Invoices / Vendor Bills on the portal at `/my`. To fix this, this commit adds a rule to prevent the hr_expense_team_approver from reading any move that does not have at least one line with an associated expense_id. TT48242 closes odoo/odoo#158323 X-original-commit: 869fb231deaa986e687749ba639123988ceebc66 Signed-off-by: Florian Gilbert (flg) <flg@odoo.com>
Odoo
Odoo is a suite of web based open source business apps.
The main Odoo Apps include an Open Source CRM, Website Builder, eCommerce, Warehouse Management, Project Management, Billing & Accounting, Point of Sale, Human Resources, Marketing, Manufacturing, ...
Odoo Apps can be used as stand-alone applications, but they also integrate seamlessly so you get a full-featured Open Source ERP when you install several Apps.
Getting started with Odoo
For a standard installation please follow the Setup instructions from the documentation.
To learn the software, we recommend the Odoo eLearning, or Scale-up, the business game. Developers can start with the developer tutorials