Abdelouahab (abla)
d44af30816
To reproduce
============
- Connect with Mitchell Admin
- Go to Employee -> Settings and uncheck "Skills Management"
- Go to Settings -> Users, create a user "Test" and give him access to 2 companies (e.g. My Company [San Fransisco] and My Company [Chicago])
- Set current company to My Company [San Fransisco], go to Employees, create an employee record and associate it with your test user (in HR Settings tab)
- Set current company to My Company [Chicago] and create another employee and associate it with your test user too
- Connect as "test" user and go to my profile
- Try to change your langage (From English US to French) ==> Access rights error
Purpose
=======
When the `OnChange` is triggred we try to read the two employees linked to this user, but one of this employees is in unslected company
which leads to Access rights error.
Specification
=============
To solve the issue the domain in the security rule **Employee multi company rule** has been updated, where we added the condition
`('user_id', '=', user.id)` which gives the user the ability to read the needed data.
opw-2793123
closes odoo/odoo#87244
X-original-commit: 5916e15f6fa29fd89e12472b316475e757001945
Signed-off-by: Kevin Baptiste <kba@odoo.com>
66 lines
3.1 KiB
XML
66 lines
3.1 KiB
XML
<?xml version="1.0" encoding="utf-8"?>
|
|
<odoo>
|
|
|
|
<record id="base.module_category_human_resources_employees" model="ir.module.category">
|
|
<field name="description">Helps you manage your employees.</field>
|
|
<field name="sequence">9</field>
|
|
</record>
|
|
|
|
<record id="group_hr_user" model="res.groups">
|
|
<field name="name">Officer</field>
|
|
<field name="category_id" ref="base.module_category_human_resources_employees"/>
|
|
<field name="implied_ids" eval="[(6, 0, [ref('base.group_private_addresses'), ref('base.group_user')])]"/>
|
|
<field name="comment">The user will be able to approve document created by employees.</field>
|
|
</record>
|
|
|
|
<record id="group_hr_manager" model="res.groups">
|
|
<field name="name">Administrator</field>
|
|
<field name="comment">The user will have access to the human resources configuration as well as statistic reports.</field>
|
|
<field name="category_id" ref="base.module_category_human_resources_employees"/>
|
|
<field name="implied_ids" eval="[(4, ref('group_hr_user'))]"/>
|
|
<field name="users" eval="[(4, ref('base.user_root')), (4, ref('base.user_admin'))]"/>
|
|
</record>
|
|
|
|
<data noupdate="1">
|
|
<record id="base.default_user" model="res.users">
|
|
<field name="groups_id" eval="[(4,ref('group_hr_manager'))]"/>
|
|
</record>
|
|
|
|
<record id="hr_employee_comp_rule" model="ir.rule">
|
|
<field name="name">Employee multi company rule</field>
|
|
<field name="model_id" ref="model_hr_employee"/>
|
|
<field name="domain_force">['|',('company_id','=',False),('company_id', 'in', company_ids)]</field>
|
|
</record>
|
|
|
|
<record id="hr_dept_comp_rule" model="ir.rule">
|
|
<field name="name">Department multi company rule</field>
|
|
<field name="model_id" ref="model_hr_department"/>
|
|
<field name="domain_force">['|',('company_id','=',False),('company_id', 'in', company_ids)]</field>
|
|
</record>
|
|
|
|
<record id="hr_employee_public_comp_rule" model="ir.rule">
|
|
<field name="name">Employee multi company rule</field>
|
|
<field name="model_id" ref="model_hr_employee_public"/>
|
|
<field name="domain_force">['|','|',('user_id', '=', user.id),('company_id', '=',False),('company_id', 'in', company_ids)]</field>
|
|
</record>
|
|
|
|
<record id="hr_job_comp_rule" model="ir.rule">
|
|
<field name="name">Job multi company rule</field>
|
|
<field name="model_id" ref="model_hr_job"/>
|
|
<field name="domain_force">['|',('company_id','=',False),('company_id', 'in', company_ids)]</field>
|
|
</record>
|
|
|
|
<record id="hr_plan_company_rule" model="ir.rule">
|
|
<field name="name">Plan multi-company rule</field>
|
|
<field name="model_id" ref="model_hr_plan"/>
|
|
<field name="domain_force">['|', ('company_id', '=', False), ('company_id', 'in', company_ids)]</field>
|
|
</record>
|
|
|
|
<record id="hr_plan_activity_type_company_rule" model="ir.rule">
|
|
<field name="name">Plan Activity Type multi-company rule</field>
|
|
<field name="model_id" ref="model_hr_plan_activity_type"/>
|
|
<field name="domain_force">['|', ('company_id', '=', False), ('company_id', 'in', company_ids)]</field>
|
|
</record>
|
|
</data>
|
|
</odoo>
|