Damien Bouvy
ba93b4a243
Security rules are added in the sale module for transactions and tokens, but it is entirely possible to have the payment module without those, and preventing invcoicing users from accessing transactions is functionnaly stupid - they are often required to check payment statuses, references, etc. closes odoo/odoo#52139 Signed-off-by: Damien Bouvy (dbo) <dbo@odoo.com>
32 lines
1.7 KiB
XML
32 lines
1.7 KiB
XML
<?xml version="1.0" encoding="utf-8"?>
|
|
<odoo noupdate="1">
|
|
|
|
<record id="payment_transaction_user_rule" model="ir.rule">
|
|
<field name="name">Access own payment transaction only</field>
|
|
<field name="model_id" ref="payment.model_payment_transaction"/>
|
|
<field name="domain_force">['|',('partner_id','=',False), ('partner_id','=',user.partner_id.id) ]</field>
|
|
<field name="groups" eval="[(4, ref('base.group_user')), (4, ref('base.group_portal')), (4, ref('base.group_public'))]"/>
|
|
</record>
|
|
<record id="payment_token_user_rule" model="ir.rule">
|
|
<field name="name">Access own payment tokens only</field>
|
|
<field name="model_id" ref="payment.model_payment_token"/>
|
|
<field name="domain_force">['|', ('partner_id','=',user.partner_id.id), ('partner_id', '=', user.partner_id.commercial_partner_id.id)]</field>
|
|
<field name="groups" eval="[(4, ref('base.group_user')), (4, ref('base.group_portal')), (4, ref('base.group_public'))]"/>
|
|
</record>
|
|
|
|
<record id="payment_transaction_billing_rule" model="ir.rule">
|
|
<field name="name">Access every payment transaction</field>
|
|
<field name="model_id" ref="payment.model_payment_transaction"/>
|
|
<field name="domain_force">[(1, '=', 1)]</field>
|
|
<field name="groups" eval="[(4, ref('account.group_account_invoice'))]"/>
|
|
</record>
|
|
|
|
<record id="payment_token_salesman_rule" model="ir.rule">
|
|
<field name="name">Access every payment token</field>
|
|
<field name="model_id" ref="payment.model_payment_token"/>
|
|
<field name="domain_force">[(1, '=', 1)]</field>
|
|
<field name="groups" eval="[(4, ref('account.group_account_invoice'))]"/>
|
|
</record>
|
|
|
|
</odoo>
|