Odoo/addons/website_slides/security, branch 14.0 The current checkout of upstream Odoo [IMP] *: declare ir.rule in noupdate 2020-03-20T15:21:25+00:00 Victor Feyens vfe@odoo.com 2020-03-10T17:07:12+00:00 a3ded9043d34229e4547e16625a86dfbebdbcfaf ir.rule are default values but can be customized based on the company's policy and needs. This is typically a record that is in noupdate as should be customization-friendly. 
ir.rule are default values but can be customized based on the
company's policy and needs.
This is typically a record that is in noupdate as should be
customization-friendly.
[IMP] *: remove global field definition in ir rules xml 2020-03-20T15:15:40+00:00 Victor Feyens vfe@odoo.com 2020-03-10T17:06:44+00:00 532c083cbbe0ee6e7a940e2bdc9c677bd56b62fa It is a computed field, there is no need to manually set its value. 
It is a computed field, there is no need to manually set its value.
[FIX] slides: add mising rights for eLearning managers 2020-03-18T12:39:11+00:00 Thibault Delavallée tde@odoo.com 2020-03-18T11:12:13+00:00 41b83e425b286c12d8c65369ce72ce5fa6455422 Full rights were not granted on technical models for managers leading to issues notably when archiving. Followup of 90bf317c013323ed9f6195d61440e2bd0e09ac2c Task ID 2219806 closes odoo/odoo#47911 X-original-commit: c78553340008c1094bfc2c4dd554c5ad5f368fe9 Signed-off-by: Thibault Delavallee (tde) <tde@openerp.com> 
Full rights were not granted on technical models for managers leading
to issues notably when archiving.

Followup of 90bf317c013323ed9f6195d61440e2bd0e09ac2c

Task ID 2219806

closes odoo/odoo#47911

X-original-commit: c78553340008c1094bfc2c4dd554c5ad5f368fe9
Signed-off-by: Thibault Delavallee (tde) <tde@openerp.com>
[ADD] *: add ir.model.access on all transient models 2020-02-04T16:54:18+00:00 Martin Trigaux mat@odoo.com 2020-01-14T12:49:55+00:00 65530dfd6a0486f44134917f5cc42a2c30b95762 Following changes needing ir.model.access on transient models too. Remove groups declaration on the action to move it to ir.model.access when possible. Rules are strict by default with no unlink access by default and high priviledge asked. Adaptations may be needed later. Write access is given as a wizard may need to be modified in case the action triggers an error and the user has to correct a value account*: use account.group_account_user for all transient by default remove account.print.journal relic stock*: use stock.group_stock_user by default survey: survey user can send invitations mail: allow any employee to execute wizards additional verifications are made to ensure they are executed only on the documents the user has access to you give portal access to mail.compose.message as portal still does some actions like posting messages on the forum add ir.rule to avoid reading somebody else messages increase the query count because of undeterminist count crm: saleman for lead2opp, manager for massmailing partner manager for actions linked to partners avoid a write in test_lead_lost sms: any employee can send sms mrp: mrp user can execute wizards give unlink access as making write during do_produce operation base_import: employees can import files delivery: stock user can deliver event_sale: sale user can configure the wizards event user inherit from sale rights gamification: employee can give badge google_service: resolve FIXME hr: add specific rights manager can set a plan according to group on button anyone who can write on an employee can register a departure hr_expense: set rights based on buttons hr_holidays: an approver can make a summary report hr_recruitment: recruiter can refuse a candidate hr_timesheet: can use the wizard if can create a timesheet l10n_eu_service: managers can create fiscal positions mass_mailing: same group as on mass.mailing.list membership: accountant can create invoice from membership payment: accountant can create a link as the source is an account.move keep the payment.acquirer.onboarding.wizard to system user only as it is called during company configuration point_of_sale: PoS manager only can use wizards never create closing_balance_confirm_wizard records product_expiry: stock user has rights on stock.picking product_margin: access from accounting menus repair: same rules as for above models sale: set ir.rule for self wizard only add rule from model introduced in payment to add salesman group sale_crm: saleman can create a quotation from a lead sale_coupon: any saleman can generate coupon add self ir.rule sale_product_configurator: salesman can select product variants snailmail: employee can send letters website: designers can write on website website_crm_partner_assign: same rule as group on action website_sale: sale ACL as for payment.acquirer.onboarding.wizard website_slides: anyone can send invitation base: base.language.*: allow employee (cf lang_install) change.password.user: can not read change password wizard of other users test.*: no access is needed Courtesy of Damien Bouvy, William Andre and Antoine Prieëls for review of acl 
Following changes needing ir.model.access on transient models too.
Remove groups declaration on the action to move it to ir.model.access
when possible.
Rules are strict by default with no unlink access by default and high
priviledge asked. Adaptations may be needed later.
Write access is given as a wizard may need to be modified in case the
action triggers an error and the user has to correct a value

account*: use account.group_account_user for all transient by default
	  remove account.print.journal relic
stock*: use stock.group_stock_user by default
survey: survey user can send invitations
mail: allow any employee to execute wizards
      additional verifications are made to ensure they are executed
      only on the documents the user has access to you
      give portal access to mail.compose.message as portal still does
      some actions like posting messages on the forum
      add ir.rule to avoid reading somebody else messages
      increase the query count because of undeterminist count
crm: saleman for lead2opp, manager for massmailing
     partner manager for actions linked to partners
     avoid a write in test_lead_lost
sms: any employee can send sms
mrp: mrp user can execute wizards
     give unlink access as making write during do_produce operation
base_import: employees can import files
delivery: stock user can deliver
event_sale: sale user can configure the wizards
	    event user inherit from  sale rights
gamification: employee can give badge
google_service: resolve FIXME
hr: add specific rights
    manager can set a plan according to group on button
    anyone who can write on an employee can register a departure
hr_expense: set rights based on buttons
hr_holidays: an approver can make a summary report
hr_recruitment: recruiter can refuse a candidate
hr_timesheet: can use the wizard if can create a timesheet
l10n_eu_service: managers can create fiscal positions
mass_mailing: same group as on mass.mailing.list
membership: accountant can create invoice from membership
payment: accountant can create a link
	 as the source is an account.move
	 keep the payment.acquirer.onboarding.wizard to system user
	 only as it is called during company configuration
point_of_sale: PoS manager only can use wizards
	       never create closing_balance_confirm_wizard records
product_expiry: stock user has rights on stock.picking
product_margin: access from accounting menus
repair: same rules as for above models
sale: set ir.rule for self wizard only
      add rule from model introduced in payment to add salesman group
sale_crm: saleman can create a quotation from a lead
sale_coupon: any saleman can generate coupon
	     add self ir.rule
sale_product_configurator: salesman can select product variants
snailmail: employee can send letters
website: designers can write on website
website_crm_partner_assign: same rule as group on action
website_sale: sale ACL as for payment.acquirer.onboarding.wizard
website_slides: anyone can send invitation

base: base.language.*: allow employee (cf lang_install)
      change.password.user: can not read change password wizard of
      other users
      test.*: no access is needed

Courtesy of Damien Bouvy, William Andre and Antoine Prieëls for review
of acl
[IMP] website_slides: allow to download slide content and additional resources 2019-12-24T09:53:20+00:00 Patrick Hoste pko@odoo.com 2019-09-09T12:18:50+00:00 1894dc54148bd008ffd8ab29ce5cf6cb9c4afaea PURPOSE Currently eLearning lacks feature of having downloadable resources on lessons. Indeed for example teachers would like to attach zip files or other resources linked to a given lesson. SPECIFICATIONS You can now allow the user to download the slide content for pdf and image slides. A new icon will be visible next to the fullscreen button on the pdf viewer. Course maintainers can also add additional resources to a slide which will be available to download for the user. Task ID 2066741 PR #39890 Signed-off-by: Thibault Delavallee (tde) <tde@openerp.com> 
PURPOSE

Currently eLearning lacks feature of having downloadable resources on
lessons. Indeed for example teachers would like to attach zip files or
other resources linked to a given lesson.

SPECIFICATIONS

You can now allow the user to download the slide content for pdf and image
slides. A new icon will be visible next to the fullscreen button on the pdf
viewer.

Course maintainers can also add additional resources to a slide which will be
available to download for the user.

Task ID 2066741
PR #39890

Signed-off-by: Thibault Delavallee (tde) <tde@openerp.com>
[REF] website_slides: define specific eLearning user groups 2019-12-12T14:12:51+00:00 mcm-odoo mcm@odoo.com 2019-10-28T09:58:28+00:00 90bf317c013323ed9f6195d61440e2bd0e09ac2c PURPOSE Have user groups specific to eLearning to separate them from generic website editors. Indeed this is a specific work area and require more than pure design skills. SPECIFICATIONS Two user groups are added in this commit * group_website_slides_officer + can read any course/slide + can create a course (will be responsible) + can write on its courses + can upload slides to the courses he is responsible + can publish slides to the courses he is responsible - cannot unlink courses/slides (you should archive them) * implies group_website_publisher in order to see the top navbar in frontend with the publish toggle button and the new content button; * group_website_slides_manager: has full rights + can read any course/slide; + can create a course; + can add slide to any courses; + can publish any courses/slides; + can unlink any courses/slides; + has access to reporting menu entries; Rights for other groups are untouched for courses / slides. As a reminder we still support responsibles being outside of eLearning groups, for example if an employee is a teacher that handles a course: * people in upload_group_ids of a channel can upload slides, even if they don't belong to any eLearning group; * people responsible of a course can upload and publish slides even if they don't belong to any eLearning group (done through controller as they don't have real rights on underlying models); We choose to keep the survey rights separated from eLearning ones. Indeed it is easy in odoo to update the imply_ids field of groups if necessary to link survey / eLearning groups; default user template can also be updated easily. Standard Odoo should therefore correctly separate those groups. The only specific rights is that eLearning officers can read all surveys, allowing to choose them for certification-based courses. LINKS Task ID 2062462 PR #39485 Signed-off-by: Thibault Delavallee (tde) <tde@openerp.com> 
PURPOSE

Have user groups specific to eLearning to separate them from generic website
editors. Indeed this is a specific work area and require more than pure design
skills.

SPECIFICATIONS

Two user groups are added in this commit

  * group_website_slides_officer

    + can read any course/slide
    + can create a course (will be responsible)
    + can write on its courses
    + can upload slides to the courses he is responsible
    + can publish slides to the courses he is responsible
    - cannot unlink courses/slides (you should archive them)

    * implies group_website_publisher in order to see the top navbar in
      frontend with the publish toggle button and the new content button;

  * group_website_slides_manager: has full rights

    + can read any course/slide;
    + can create a course;
    + can add slide to any courses;
    + can publish any courses/slides;
    + can unlink any courses/slides;
    + has access to reporting menu entries;

Rights for other groups are untouched for courses / slides. As a reminder
we still support responsibles being outside of eLearning groups, for example
if an employee is a teacher that handles a course:

  * people in upload_group_ids of a channel can upload slides, even if they
    don't belong to any eLearning group;
  * people responsible of a course can upload and publish slides even if they
    don't belong to any eLearning group (done through controller as they
    don't have real rights on underlying models);

We choose to keep the survey rights separated from eLearning ones. Indeed
it is easy in odoo to update the imply_ids field of groups if necessary
to link survey / eLearning groups; default user template can also be updated
easily. Standard Odoo should therefore correctly separate those groups. The
only specific rights is that eLearning officers can read all surveys, allowing
to choose them for certification-based courses.

LINKS

Task ID 2062462
PR #39485

Signed-off-by: Thibault Delavallee (tde) <tde@openerp.com>
[REF] website_slides: replace slide.category by slide with is_category flag 2019-08-08T08:29:34+00:00 qmo-odoo qmo@odoo.com 2019-05-13T11:09:31+00:00 b180c66a80ae3ae34716f8524a990c9e9d2c1aa7 PURPOSE Like already done for sale order, invoice of survey, purpose of this commit is to remove category model and replace by a flagged line (slide). It allows to easily reorder slides in an embedded list view. SPECIFICATIONS Instead of having a fully fledged slide.category model, slide.slide will serve that purpose with a is_category flag. This will allow to drag and drop slides and sections in the channel form view. This change had an impact on the way slides were added/sorted on the front-end. In fact, whenever a slide is added from the front-end, a resequencing of all the slides in the course has to be triggered. Category of a slide is now a computed field based on the sequence. Order of slides is based on sequence, with categories splitting the slide list based on is_category flag. In this commit tests are added. Some cleaning in tests is also performed to speedup a bit tests (savepointcase) and some cleaning / renaming to ease their understanding. Future commit will add JS necessary to manage slides in the section list view. LINKS TaskID: 1978731 PR: #33255 
PURPOSE

Like already done for sale order, invoice of survey, purpose of this commit
is to remove category model and replace by a flagged line (slide). It allows
to easily reorder slides in an embedded list view.

SPECIFICATIONS

Instead of having a fully fledged slide.category model, slide.slide will serve
that purpose with a is_category flag. This will allow to drag and drop slides
and sections in the channel form view.

This change had an impact on the way slides were added/sorted on the front-end.
In fact, whenever a slide is added from the front-end, a resequencing of all
the slides in the course has to be triggered.

Category of a slide is now a computed field based on the sequence. Order
of slides is based on sequence, with categories splitting the slide list based
on is_category flag.

In this commit tests are added. Some cleaning in tests is also performed to
speedup a bit tests (savepointcase) and some cleaning / renaming to ease
their understanding.

Future commit will add JS necessary to manage slides in the section list view.

LINKS

TaskID: 1978731
PR: #33255
 [FIX] website_slides: Remove read access on slide.answer 2019-05-06T06:24:38+00:00 qmo-odoo qmo@odoo.com 2019-03-25T08:39:17+00:00 b6f185b45d90973f53823d7ac10323e8dda8d045 This commit removes the read access on slide.answer for all users except website_publisher and admin Task: #1947884 PR: #32083 Signed-off-by: Thibault Delavallee (tde) <tde@openerp.com> 
This commit removes the read access on slide.answer for all
users except website_publisher and admin

Task: #1947884
PR: #32083

Signed-off-by: Thibault Delavallee (tde) <tde@openerp.com>
 [REF] website_slides: improve and make access options clearer 2019-02-19T16:52:07+00:00 Thibault Delavallée tde@odoo.com 2019-02-19T11:08:52+00:00 18f917fe3b7d2bd06ae94254cf42148ad022d768 Purpose is to ensure more advanced use cases are still supported in new elearning platform in addition to more public use cases. Fields controlling access are now * enroll: who can enroll on course: public (everyone, simply click on join button), invite (added by already members) and payment (in bridge with website_sale, if SO with product is confirmed); * enroll_group_ids: automatically add members of those groups to the channel to ease having groups for a given subset of users; * visibility: who can see a channel and its slides: public (everyone, it means channel is visible on website for example), members (hidden for non members) * website_published on channels and slides; non publishers cannot see what is not published, whatever other parameters; * upload_group_ids: who can upload on a channel; * download_security on a slide is completely removed as it makes no sense for most slide types; To ensure a better user experience responsible of a channel is added in its members. People uploading a slide are now also allowed to read it to avoid having inconsistency behavior between upload_group_ids and access rules. Some tests are added. This commit is linked to task ID 1942836 and PR #31239. Co-Authored-By: Aurélien Warnon <awa@odoo.com> Co-Authored-By: Thibault Delavallée <tde@odoo.com> 
Purpose is to ensure more advanced use cases are still supported in new
elearning platform in addition to more public use cases. Fields controlling
access are now

 * enroll: who can enroll on course: public (everyone, simply click on join
   button), invite (added by already members) and payment (in bridge with
   website_sale, if SO with product is confirmed);
 * enroll_group_ids: automatically add members of those groups to the channel
   to ease having groups for a given subset of users;
 * visibility: who can see a channel and its slides: public (everyone, it means
   channel is visible on website for example), members (hidden for non members)
 * website_published on channels and slides; non publishers cannot see what
   is not published, whatever other parameters;
 * upload_group_ids: who can upload on a channel;
 * download_security on a slide is completely removed as it makes no sense
   for most slide types;

To ensure a better user experience responsible of a channel is added in its
members. People uploading a slide are now also allowed to read it to avoid
having inconsistency behavior between upload_group_ids and access rules.

Some tests are added.

This commit is linked to task ID 1942836 and PR #31239.

Co-Authored-By: Aurélien Warnon <awa@odoo.com>
Co-Authored-By: Thibault Delavallée <tde@odoo.com>
 [IMP] website_slides: Add elearning feature to slides 2019-02-19T13:11:15+00:00 qmo-odoo qmo@odoo.com 2018-11-21T09:06:40+00:00 c564ae6c87a79832d94de99d650d437fcf68b1c1 Purpose of this commit is to introduce a new way of displaying and managing slides in eLearning module. Its purpose is to give a better experience to users when going through a course. Notably a fullscreen mode allows to take lessons one by one without going out of the elearning display. Integration of all slide types eases taking the course step by step. Quiz are introduced in this commit. Those are an addition to slides with some question / answers (multiple choice). It allows customer to gain karma and improves gamification. Certifications are still done using the survey application. Quiz targets only small tests at the end of a given slide. A new widget is added to display and control slide display in fullscreen mode. Old display is still available for documentation channels or when going out of fullscreen mode, to see details on comments / review / statistics and have access to share options. This commit is linked to task ID 1902304 and PR #29876. It closes the main work on refactoring website slides into eLearning, with other tasks already merged in current community [1][2][3][4][5]. [1] Task ID 1940360 landed at b2149bc7a274217a0b96e587abd52093bd98e5e8: certification inclusion [2] Task ID 1936153 landed at 6c6179e57cede3d9889c33873740a7b1ddecda2e: homepage inclusion [3] Task ID 1937160 landed at 8b7605c9e5df4a700b0139d1781db24ae5d31626: selling courses [4] Task ID 1922159 and 1940516 landed at 5fa651cb013ac67d7ba592498c4cf2770dec2483 and 6a64c3ce821f080969e49e5e760e52ae9bfc26cc: new user profile and gamification of slides / forum [5] Task ID 1938643 landed at 77b5673a0dd220b3c28e88f8acbb5274b486c5bd: upload channel/slide 
Purpose of this commit is to introduce a new way of displaying and managing
slides in eLearning module. Its purpose is to give a better experience to
users when going through a course. Notably a fullscreen mode allows to take
lessons one by one without going out of the elearning display. Integration
of all slide types eases taking the course step by step.

Quiz are introduced in this commit. Those are an addition to slides with
some question / answers (multiple choice). It allows customer to gain karma
and improves gamification. Certifications are still done using the survey
application. Quiz targets only small tests at the end of a given slide.

A new widget is added to display and control slide display in fullscreen
mode. Old display is still available for documentation channels or when
going out of fullscreen mode, to see details on comments / review / statistics
and have access to share options.

This commit is linked to task ID 1902304 and PR #29876. It closes the main
work on refactoring website slides into eLearning, with other tasks already
merged in current community [1][2][3][4][5].

[1] Task ID 1940360 landed at b2149bc7a274217a0b96e587abd52093bd98e5e8: certification inclusion
[2] Task ID 1936153 landed at 6c6179e57cede3d9889c33873740a7b1ddecda2e: homepage inclusion
[3] Task ID 1937160 landed at 8b7605c9e5df4a700b0139d1781db24ae5d31626: selling courses
[4] Task ID 1922159 and 1940516 landed at 5fa651cb013ac67d7ba592498c4cf2770dec2483 and 6a64c3ce821f080969e49e5e760e52ae9bfc26cc:
    new user profile and gamification of slides / forum
[5] Task ID 1938643 landed at 77b5673a0dd220b3c28e88f8acbb5274b486c5bd: upload channel/slide