Nicolas Martinelli
23b2bba925
By default, an event can be modified by any employee. This is also the case for private events, displayed as "Busy" to other users. However, since any user can modify an event, nothing prevents him to change the privacy setting in order to be able to see the content. This commit introduces a global record rule which only allows the followers of an event to modify it. opw-705079
38 lines
1.7 KiB
XML
38 lines
1.7 KiB
XML
<?xml version="1.0" encoding="utf-8"?>
|
|
<openerp>
|
|
<data noupdate="1">
|
|
|
|
<record id="calendar_event_rule_my" model="ir.rule">
|
|
<field name="name">Own events</field>
|
|
<field ref="model_calendar_event" name="model_id"/>
|
|
<field name="domain_force">[('partner_ids','in',user.partner_id.id)]</field>
|
|
<field name="groups" eval="[(4, ref('base.group_portal'))]"/>
|
|
</record>
|
|
|
|
<record id="calendar_event_rule_employee" model="ir.rule">
|
|
<field ref="model_calendar_event" name="model_id"/>
|
|
<field name="name">All Calendar Event for employees</field>
|
|
<field name="domain_force">[(1,'=',1)]</field>
|
|
<field eval="[(4,ref('base.group_user'))]" name="groups"/>
|
|
</record>
|
|
|
|
<record id="calendar_attendee_rule_my" model="ir.rule">
|
|
<field name="name">Own attendees</field>
|
|
<field ref="model_calendar_attendee" name="model_id"/>
|
|
<field name="domain_force">[(1,'=',1)]</field>
|
|
<field name="groups" eval="[(4, ref('base.group_portal'))]"/>
|
|
</record>
|
|
|
|
<record id="calendar_event_rule_private" model="ir.rule">
|
|
<field ref="model_calendar_event" name="model_id"/>
|
|
<field name="name">Private events</field>
|
|
<field name="domain_force">['|', ('class', '!=', 'private'), '&', ('class', '=', 'private'), ('partner_ids', 'in', user.partner_id.id)]</field>
|
|
<field name="perm_read" eval="False"/>
|
|
<field name="perm_write" eval="True"/>
|
|
<field name="perm_create" eval="True"/>
|
|
<field name="perm_unlink" eval="True"/>
|
|
</record>
|
|
|
|
</data>
|
|
</openerp>
|