diff options
| author | Thibault Delavallée <tde@odoo.com> | 2016-09-14 16:42:35 +0200 |
|---|---|---|
| committer | Thibault Delavallée <tde@odoo.com> | 2016-09-14 16:45:01 +0200 |
| commit | 6e2a455947ef73d21bf99cd369f7fc887d3e89d7 (patch) | |
| tree | b8e56d60fb3ad4fa003b0aa666f1fe96eec437ca | |
| parent | 9c9ac8c43afd1a2d943d425583ec56eed014d2ed (diff) | |
[FIX] mail: restrict write access rights of portal users to their own follower and notification entries
| -rw-r--r-- | addons/mail/security/mail_security.xml | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/addons/mail/security/mail_security.xml b/addons/mail/security/mail_security.xml index 65495db6925..d5a5b5422c9 100644 --- a/addons/mail/security/mail_security.xml +++ b/addons/mail/security/mail_security.xml @@ -16,7 +16,7 @@ <record id="mail_followers_read_write_own" model="ir.rule"> <field name="name">mail.followers: write its own entries</field> <field name="model_id" ref="model_mail_followers"/> - <field name="groups" eval="[(4, ref('base.group_user'))]"/> + <field name="groups" eval="[(4, ref('base.group_user')), (4, ref('base.group_portal'))]"/> <field name="domain_force">[('partner_id', '=', user.partner_id.id)]</field> <field name="perm_create" eval="False"/> <field name="perm_unlink" eval="False"/> @@ -26,7 +26,7 @@ <record id="ir_rule_mail_notifications_group_user" model="ir.rule"> <field name="name">mail.notifications: group_user: write its own entries</field> <field name="model_id" ref="model_mail_notification"/> - <field name="groups" eval="[(4, ref('base.group_user'))]"/> + <field name="groups" eval="[(4, ref('base.group_user')), (4, ref('base.group_portal'))]"/> <field name="domain_force">[('res_partner_id', '=', user.partner_id.id)]</field> <field name="perm_create" eval="False"/> <field name="perm_unlink" eval="False"/> |