Martin Trigaux
65530dfd6a
Following changes needing ir.model.access on transient models too.
Remove groups declaration on the action to move it to ir.model.access
when possible.
Rules are strict by default with no unlink access by default and high
priviledge asked. Adaptations may be needed later.
Write access is given as a wizard may need to be modified in case the
action triggers an error and the user has to correct a value
account*: use account.group_account_user for all transient by default
remove account.print.journal relic
stock*: use stock.group_stock_user by default
survey: survey user can send invitations
mail: allow any employee to execute wizards
additional verifications are made to ensure they are executed
only on the documents the user has access to you
give portal access to mail.compose.message as portal still does
some actions like posting messages on the forum
add ir.rule to avoid reading somebody else messages
increase the query count because of undeterminist count
crm: saleman for lead2opp, manager for massmailing
partner manager for actions linked to partners
avoid a write in test_lead_lost
sms: any employee can send sms
mrp: mrp user can execute wizards
give unlink access as making write during do_produce operation
base_import: employees can import files
delivery: stock user can deliver
event_sale: sale user can configure the wizards
event user inherit from sale rights
gamification: employee can give badge
google_service: resolve FIXME
hr: add specific rights
manager can set a plan according to group on button
anyone who can write on an employee can register a departure
hr_expense: set rights based on buttons
hr_holidays: an approver can make a summary report
hr_recruitment: recruiter can refuse a candidate
hr_timesheet: can use the wizard if can create a timesheet
l10n_eu_service: managers can create fiscal positions
mass_mailing: same group as on mass.mailing.list
membership: accountant can create invoice from membership
payment: accountant can create a link
as the source is an account.move
keep the payment.acquirer.onboarding.wizard to system user
only as it is called during company configuration
point_of_sale: PoS manager only can use wizards
never create closing_balance_confirm_wizard records
product_expiry: stock user has rights on stock.picking
product_margin: access from accounting menus
repair: same rules as for above models
sale: set ir.rule for self wizard only
add rule from model introduced in payment to add salesman group
sale_crm: saleman can create a quotation from a lead
sale_coupon: any saleman can generate coupon
add self ir.rule
sale_product_configurator: salesman can select product variants
snailmail: employee can send letters
website: designers can write on website
website_crm_partner_assign: same rule as group on action
website_sale: sale ACL as for payment.acquirer.onboarding.wizard
website_slides: anyone can send invitation
base: base.language.*: allow employee (cf lang_install)
change.password.user: can not read change password wizard of
other users
test.*: no access is needed
Courtesy of Damien Bouvy, William Andre and Antoine Prieëls for review
of acl
13 KiB
13 KiB
| 1 | id | name | model_id:id | group_id:id | perm_read | perm_write | perm_create | perm_unlink |
|---|---|---|---|---|---|---|---|---|
| 2 | access_decimal_precision_config | decimal.precision configuration | model_decimal_precision | group_system | 1 | 1 | 1 | 1 |
| 3 | access_ir_attachment_group_user | ir_attachment group_user | model_ir_attachment | group_user | 1 | 1 | 1 | 1 |
| 4 | access_ir_attachment_group_portal_public | ir_attachment group_portal_public | model_ir_attachment | 0 | 0 | 0 | 0 | |
| 5 | access_ir_cron_group_cron | ir_cron group_cron | model_ir_cron | group_system | 1 | 1 | 1 | 1 |
| 6 | access_ir_exports_group_system | ir_exports group_system | model_ir_exports | base.group_user | 1 | 1 | 1 | 1 |
| 7 | access_ir_exports_line_group_system | ir_exports_line group_system | model_ir_exports_line | base.group_user | 1 | 1 | 1 | 1 |
| 8 | access_ir_model_group_erp_manager | ir_model group_erp_manager | model_ir_model | group_erp_manager | 1 | 1 | 1 | 1 |
| 9 | access_ir_model_constraint_group_erp_manager | ir_model_constraint group_erp_manager | model_ir_model_constraint | group_erp_manager | 1 | 1 | 1 | 1 |
| 10 | access_ir_model_relation_group_erp_manager | ir_model_relation group_erp_manager | model_ir_model_relation | group_erp_manager | 1 | 1 | 1 | 1 |
| 11 | access_ir_model_access_group_erp_manager | ir_model_access_group_erp_manager | model_ir_model_access | group_erp_manager | 1 | 1 | 1 | 1 |
| 12 | access_ir_model_data_group_erp_manager | ir_model_data group_erp_manager | model_ir_model_data | group_erp_manager | 1 | 1 | 1 | 1 |
| 13 | access_ir_model_fields_group_erp_manager | ir_model_fields group_erp_manager | model_ir_model_fields | group_erp_manager | 1 | 1 | 1 | 1 |
| 14 | access_ir_model_fields_selection_group_erp_manager | ir_model_fields_selection group_erp_manager | model_ir_model_fields_selection | group_erp_manager | 1 | 1 | 1 | 1 |
| 15 | access_ir_model_user | ir_model_all | model_ir_model | base.group_user | 1 | 0 | 0 | 0 |
| 16 | access_ir_model_data_user | ir_model_data user | model_ir_model_data | base.group_user | 1 | 0 | 1 | 0 |
| 17 | access_ir_model_fields_user | ir_model_fields all | model_ir_model_fields | base.group_user | 1 | 0 | 0 | 0 |
| 18 | access_ir_model_fields_selection_user | ir_model_fields_selection all | model_ir_model_fields_selection | base.group_user | 1 | 0 | 0 | 0 |
| 19 | access_ir_module_category_group_user | ir_module_category group_user | model_ir_module_category | group_erp_manager | 1 | 0 | 0 | 0 |
| 20 | access_ir_module_module_group_user | ir_module_module group_user | model_ir_module_module | group_system | 1 | 1 | 1 | 1 |
| 21 | access_ir_module_module_dependency_group_system | ir_module_module_dependency group_system | model_ir_module_module_dependency | group_system | 1 | 1 | 1 | 1 |
| 22 | access_ir_module_module_exclusion_group_system | ir_module_module_exclusion group_system | model_ir_module_module_exclusion | group_system | 1 | 1 | 1 | 1 |
| 23 | access_ir_property_group_user | ir_property group_user | model_ir_property | 1 | 0 | 0 | 0 | |
| 24 | access_ir_property_group_user_manager | ir_property group_manager | model_ir_property | base.group_partner_manager | 1 | 1 | 1 | 0 |
| 25 | access_ir_rule_group_erp_manager | ir_rule group_erp_manager | model_ir_rule | group_erp_manager | 1 | 1 | 1 | 1 |
| 26 | access_ir_sequence_group_user | ir_sequence group_user | model_ir_sequence | group_user | 1 | 0 | 0 | 0 |
| 27 | access_ir_sequence_group_system | ir_sequence group_system | model_ir_sequence | group_system | 1 | 1 | 1 | 1 |
| 28 | access_ir_sequence_date_range_group_user | ir_sequence_date_range group_user | model_ir_sequence_date_range | group_user | 1 | 0 | 0 | 0 |
| 29 | access_ir_sequence_date_range_group_system | ir_sequence_date_range group_system | model_ir_sequence_date_range | group_system | 1 | 1 | 1 | 1 |
| 30 | access_ir_translation_all | ir_translation all | model_ir_translation | group_user | 1 | 1 | 1 | 1 |
| 31 | access_ir_translation_group_system | ir_translation group_system | model_ir_translation | group_system | 1 | 1 | 1 | 1 |
| 32 | access_ir_ui_menu_group_user | ir_ui_menu group_user | model_ir_ui_menu | base.group_user | 1 | 0 | 0 | 0 |
| 33 | access_ir_ui_menu_group_system | ir_ui_menu group_system | model_ir_ui_menu | group_system | 1 | 1 | 1 | 1 |
| 34 | access_ir_ui_view_group_user | ir_ui_view group_user | model_ir_ui_view | 1 | 0 | 0 | 0 | |
| 35 | access_ir_ui_view_group_system | ir_ui_view group_system | model_ir_ui_view | group_system | 1 | 1 | 1 | 1 |
| 36 | access_ir_ui_view_custom_group_user | ir_ui_view_custom_group_user | model_ir_ui_view_custom | 1 | 1 | 1 | 1 | |
| 37 | access_ir_default_all | ir_default all | model_ir_default | 1 | 0 | 0 | 0 | |
| 38 | access_ir_default_group_user | ir_default group_user | model_ir_default | group_user | 1 | 1 | 1 | 1 |
| 39 | access_ir_default_group_system | ir_default group_system | model_ir_default | group_system | 1 | 1 | 1 | 1 |
| 40 | access_res_company_group_erp_manager | res_company group_erp_manager | model_res_company | group_erp_manager | 1 | 1 | 1 | 1 |
| 41 | access_res_company_group_user | res_company group_user | model_res_company | 1 | 0 | 0 | 0 | |
| 42 | access_res_country_group_all | res_country group_user_all | model_res_country | 1 | 0 | 0 | 0 | |
| 43 | access_res_country_state_group_all | res_country_state group_user_all | model_res_country_state | 1 | 0 | 0 | 0 | |
| 44 | access_res_country_group_group_all | res_country_group group_user_all | model_res_country_group | 1 | 0 | 0 | 0 | |
| 45 | access_res_country_group_user | res_country group_user | model_res_country | group_partner_manager | 1 | 1 | 1 | 1 |
| 46 | access_res_country_state_group_user | res_country_state group_user | model_res_country_state | group_partner_manager | 1 | 1 | 1 | 1 |
| 47 | access_res_country_group_group_user | res_country_group group_user | model_res_country_group | group_partner_manager | 1 | 1 | 1 | 1 |
| 48 | access_res_currency_group_all | res_currency group_all | model_res_currency | 1 | 0 | 0 | 0 | |
| 49 | access_res_currency_rate_group_all | res_currency_rate group_all | model_res_currency_rate | 1 | 0 | 0 | 0 | |
| 50 | access_res_currency_group_system | res_currency group_system | model_res_currency | group_system | 1 | 1 | 1 | 1 |
| 51 | access_res_currency_rate_group_system | res_currency_rate group_system | model_res_currency_rate | group_system | 1 | 1 | 1 | 1 |
| 52 | access_res_groups_group_erp_manager | res_groups group_erp_manager | model_res_groups | group_erp_manager | 1 | 1 | 1 | 1 |
| 53 | access_res_groups_group_user | res_groups group_user | model_res_groups | group_user | 1 | 0 | 0 | 0 |
| 54 | access_res_lang_group_all | res_lang group_all | model_res_lang | 1 | 0 | 0 | 0 | |
| 55 | access_res_lang_group_user | res_lang group_user | model_res_lang | group_system | 1 | 1 | 1 | 1 |
| 56 | access_res_partner_public | res_partner group_public | model_res_partner | group_public | 1 | 0 | 0 | 0 |
| 57 | access_res_partner_portal | res_partner group_portal | model_res_partner | group_portal | 1 | 0 | 0 | 0 |
| 58 | access_res_partner_group_partner_manager | res_partner group_partner_manager | model_res_partner | group_partner_manager | 1 | 1 | 1 | 1 |
| 59 | access_res_partner_group_user | res_partner group_user | model_res_partner | group_user | 1 | 0 | 0 | 0 |
| 60 | access_res_partner_bank_group_user | res_partner_bank group_user | model_res_partner_bank | group_user | 1 | 0 | 0 | 0 |
| 61 | access_res_partner_bank_group_partner_manager | res_partner_bank group_partner_manager | model_res_partner_bank | group_partner_manager | 1 | 1 | 1 | 1 |
| 62 | access_res_partner_category_group_user | res_partner_category group_user | model_res_partner_category | group_user | 1 | 0 | 0 | 0 |
| 63 | access_res_partner_category_group_partner_manager | res_partner_category group_partner_manager | model_res_partner_category | group_partner_manager | 1 | 1 | 1 | 1 |
| 64 | access_res_partner_industry_group_user | res_partner_industry group_user | model_res_partner_industry | group_user | 1 | 0 | 0 | 0 |
| 65 | access_res_partner_industry_group_system | res_partner_industry group_system | model_res_partner_industry | group_system | 1 | 1 | 1 | 1 |
| 66 | access_res_partner_title_group_user | res_partner_title group_partner_manager | model_res_partner_title | group_partner_manager | 1 | 1 | 1 | 1 |
| 67 | access_res_partner_title_group_partner_manager | res_partner_title group_user | model_res_partner_title | 1 | 0 | 0 | 0 | |
| 68 | access_res_users_all | res_users all | model_res_users | 1 | 0 | 0 | 0 | |
| 69 | access_res_users_group_erp_manager | res_users group_erp_manager | model_res_users | group_erp_manager | 1 | 1 | 1 | 1 |
| 70 | access_res_users_log_all | res_users_log_all | model_res_users_log | 1 | 0 | 1 | 0 | |
| 71 | access_ir_actions_all | ir_actions_all | model_ir_actions_actions | 1 | 0 | 0 | 0 | |
| 72 | access_ir_actions_group_system | ir_actions_group_system | model_ir_actions_actions | group_system | 1 | 1 | 1 | 1 |
| 73 | access_ir_actions_act_window_all | ir_actions_act_window_all | model_ir_actions_act_window | 1 | 0 | 0 | 0 | |
| 74 | access_ir_actions_act_window_system | ir_actions_act_window_system | model_ir_actions_act_window | group_system | 1 | 1 | 1 | 1 |
| 75 | access_ir_actions_act_window_close_all | ir_actions_act_window_close_all | model_ir_actions_act_window_close | 1 | 0 | 0 | 0 | |
| 76 | access_ir_actions_act_window_close_group_system | ir_actions_act_window_close_group_system | model_ir_actions_act_window_close | group_system | 1 | 1 | 1 | 1 |
| 77 | access_ir_actions_report_all | ir_actions_report | model_ir_actions_report | 1 | 0 | 0 | 0 | |
| 78 | access_ir_actions_report_group_system | ir_actions_report_group_system | model_ir_actions_report | group_system | 1 | 1 | 1 | 1 |
| 79 | access_ir_actions_todo_group_system | ir_actions_todo group system | model_ir_actions_todo | group_system | 1 | 1 | 1 | 1 |
| 80 | access_ir_actions_act_window_view_all | ir_actions_act_window_view_all | model_ir_actions_act_window_view | 1 | 0 | 0 | 0 | |
| 81 | access_ir_actions_act_window_view_group_system | ir_actions_act_window_view_group_system | model_ir_actions_act_window_view | group_system | 1 | 1 | 1 | 1 |
| 82 | access_ir_actions_act_url_all | ir_actions_act_url_all | model_ir_actions_act_url | 1 | 0 | 0 | 0 | |
| 83 | access_ir_actions_act_url_group_system | ir_actions_act_url_group_system | model_ir_actions_act_url | group_system | 1 | 1 | 1 | 1 |
| 84 | access_ir_server_object_lines_all | ir_server_object_lines_all | model_ir_server_object_lines | 1 | 0 | 0 | 0 | |
| 85 | access_ir_server_object_lines_group_system | ir_server_object_lines_group_system | model_ir_server_object_lines | group_system | 1 | 1 | 1 | 1 |
| 86 | access_ir_actions_server_all | ir_actions_server_all | model_ir_actions_server | 1 | 0 | 0 | 0 | |
| 87 | access_ir_actions_server_group_system | ir_actions_server_group_system | model_ir_actions_server | group_system | 1 | 1 | 1 | 1 |
| 88 | access_res_bank_group_system | res_bank_group_system | model_res_bank | group_system | 1 | 1 | 1 | 1 |
| 89 | access_res_bank_group_partner_manager | res_bank_group_partner_manager | model_res_bank | group_partner_manager | 1 | 1 | 1 | 1 |
| 90 | access_res_bank_user | res_bank user | model_res_bank | group_user | 1 | 0 | 0 | 0 |
| 91 | access_ir_filter_erp_manager | ir_filters all | model_ir_filters | group_erp_manager | 1 | 1 | 1 | 1 |
| 92 | access_ir_filter_user | ir_filters all | model_ir_filters | group_user | 1 | 1 | 1 | 1 |
| 93 | access_ir_filter_portal | ir_filters all | model_ir_filters | group_portal | 1 | 1 | 1 | 1 |
| 94 | access_ir_filter_public | ir_filters all | model_ir_filters | group_public | 1 | 1 | 1 | 1 |
| 95 | access_ir_config_parameter_system | ir_config_parameter_system | model_ir_config_parameter | group_system | 1 | 1 | 1 | 1 |
| 96 | access_ir_mail_server | ir_mail_server | model_ir_mail_server | group_system | 1 | 1 | 1 | 1 |
| 97 | access_ir_actions_client | ir_actions_client all | model_ir_actions_client | 1 | 0 | 0 | 0 | |
| 98 | access_ir_logging | ir_logging admin | model_ir_logging | group_erp_manager | 1 | 1 | 1 | 1 |
| 99 | paperformat_access_portal | ir_actions_report_paperformat group_portal | model_report_paperformat | 1 | 0 | 0 | 0 | |
| 100 | paperformat_access_employee | ir_actions_report_paperformat group_system | model_report_paperformat | group_system | 1 | 1 | 1 | 1 |
| 101 | access_report_layout | access_report_layout | model_report_layout | 1 | 1 | 1 | 1 | |
| 102 | access_wizard_ir_model_menu_create | access.wizard.ir.model.menu.create | model_wizard_ir_model_menu_create | base.group_system | 1 | 1 | 1 | 0 |
| 103 | access_reset_view_arch_wizard | access.reset.view.arch.wizard | model_reset_view_arch_wizard | base.group_erp_manager | 1 | 1 | 1 | 0 |
| 104 | access_ir_demo | access.ir.demo | model_ir_demo | base.group_system | 1 | 1 | 1 | 0 |
| 105 | access_ir_demo_failure | access.ir.demo_failure | model_ir_demo_failure | base.group_system | 1 | 1 | 1 | 0 |
| 106 | access_ir_demo_failure_wizard | access.ir.demo_failure.wizard | model_ir_demo_failure_wizard | base.group_system | 1 | 1 | 1 | 0 |
| 107 | access_res_config | access.res.config | model_res_config | base.group_system | 1 | 1 | 1 | 0 |
| 108 | access_res_config_installer | access.res.config.installer | model_res_config_installer | base.group_system | 1 | 1 | 1 | 0 |
| 109 | access_res_config_settings | access.res.config.settings | model_res_config_settings | base.group_system | 1 | 1 | 1 | 0 |
| 110 | access_change_password_wizard | access.change.password.wizard | model_change_password_wizard | base.group_erp_manager | 1 | 1 | 1 | 0 |
| 111 | access_change_password_user | access.change.password.user | model_change_password_user | base.group_system | 1 | 1 | 1 | 0 |
| 112 | access_base_module_update | access.base.module.update | model_base_module_update | base.group_system | 1 | 1 | 1 | 0 |
| 113 | access_base_language_install | access.base.language.install | model_base_language_install | base.group_system | 1 | 1 | 1 | 0 |
| 114 | access_base_language_import | access.base.language.import | model_base_language_import | base.group_system | 1 | 1 | 1 | 0 |
| 115 | access_base_module_upgrade | access.base.module.upgrade | model_base_module_upgrade | base.group_system | 1 | 1 | 1 | 0 |
| 116 | access_base_module_uninstall | access.base.module.uninstall | model_base_module_uninstall | base.group_system | 1 | 1 | 1 | 0 |
| 117 | access_base_language_export | access.base.language.export | model_base_language_export | base.group_user | 1 | 1 | 1 | 0 |
| 118 | access_base_update_translations | access.base.update.translations | model_base_update_translations | base.group_system | 1 | 1 | 1 | 0 |
| 119 | access_base_partner_merge_line | access.base.partner.merge.line | model_base_partner_merge_line | base.group_system | 1 | 1 | 1 | 0 |
| 120 | access_base_partner_merge_automatic_wizard | access.base.partner.merge.automatic.wizard | model_base_partner_merge_automatic_wizard | base.group_system | 1 | 1 | 1 | 0 |
| 121 | access_base_document_layout | access.base.document.layout | model_base_document_layout | base.group_system | 1 | 1 | 1 | 0 |