Horacio Tellez
2b1e2abda3
Since 15.0, it is no longer possible to have partnerless transactions. Nonetheless, migrated databases could contain transactions without a `partner_id` set. This commit cleans existing rules to make those transactions are not accessible to unwanted users. We take the opportunity to clean the security of payment.transaction records globally. Now only admin and accounting users have access to payment.transaction records. The code of different applications has been adapted accordingly. Task - 3102824 closes odoo/odoo#113515 Related: odoo/upgrade#4564 Related: odoo/enterprise#40939 Signed-off-by: Masereel Pierre <pim@odoo.com>
46 lines
1.8 KiB
XML
46 lines
1.8 KiB
XML
<?xml version="1.0" encoding="utf-8"?>
|
|
<odoo noupdate="1">
|
|
|
|
<!-- Providers -->
|
|
|
|
<record id="payment_provider_company_rule" model="ir.rule">
|
|
<field name="name">Access providers in own companies only</field>
|
|
<field name="model_id" ref="payment.model_payment_provider"/>
|
|
<field name="domain_force">[('company_id', 'in', company_ids)]</field>
|
|
</record>
|
|
|
|
<!-- Transactions -->
|
|
|
|
<record id="transaction_company_rule" model="ir.rule">
|
|
<field name="name">Access transactions in own companies only</field>
|
|
<field name="model_id" ref="payment.model_payment_transaction"/>
|
|
<field name="domain_force">[('company_id', 'in', company_ids)]</field>
|
|
</record>
|
|
|
|
<!-- Tokens -->
|
|
|
|
<record id="payment_token_user_rule" model="ir.rule">
|
|
<field name="name">Users can access only their own tokens</field>
|
|
<field name="model_id" ref="payment.model_payment_token"/>
|
|
<field name="domain_force">[('partner_id', '=', user.partner_id.id)]</field>
|
|
<field name="groups" eval="[(4, ref('base.group_user')),
|
|
(4, ref('base.group_portal')),
|
|
(4, ref('base.group_public'))]"/>
|
|
</record>
|
|
|
|
<record id="payment_token_company_rule" model="ir.rule">
|
|
<field name="name">Access tokens in own companies only</field>
|
|
<field name="model_id" ref="payment.model_payment_token"/>
|
|
<field name="domain_force">[('company_id', 'in', company_ids)]</field>
|
|
</record>
|
|
|
|
<!-- Wizards -->
|
|
|
|
<record id="payment_capture_wizard_rule" model="ir.rule">
|
|
<field name="name">Payment Capture Wizard</field>
|
|
<field name="model_id" ref="model_payment_capture_wizard"/>
|
|
<field name="domain_force">[('create_uid', '=', user.id)]</field>
|
|
</record>
|
|
|
|
</odoo>
|