diff options
| author | Martin Trigaux <mat@openerp.com> | 2013-04-05 09:32:05 +0200 |
|---|---|---|
| committer | Martin Trigaux <mat@openerp.com> | 2013-04-05 09:32:05 +0200 |
| commit | 750a3ae2b6543fad5ccb889ae30ee7a810a98d4b (patch) | |
| tree | 6a63fcd73c1d7d0850bf76e54173039c4ae1f274 /addons/gamification/security/gamification_security.xml | |
| parent | 57c1ad67fe9cbf7a7caa6bd01008ef49ad4b6f7e (diff) | |
[IMP] better security rules
bzr revid: mat@openerp.com-20130405073205-gfcolcdv3oomlo0z
Diffstat (limited to 'addons/gamification/security/gamification_security.xml')
| -rw-r--r-- | addons/gamification/security/gamification_security.xml | 12 |
1 files changed, 9 insertions, 3 deletions
diff --git a/addons/gamification/security/gamification_security.xml b/addons/gamification/security/gamification_security.xml index 23ec3679add..227d8e21584 100644 --- a/addons/gamification/security/gamification_security.xml +++ b/addons/gamification/security/gamification_security.xml @@ -13,16 +13,22 @@ </record> </data> - <data noupdate="1"> + <data noupdate="0"> <record id="goal_user_visibility" model="ir.rule"> - <field name="name">User can only see his/her goals</field> + <!-- TODO fix private for board --> + <field name="name">User can only see his/her goals or goal from the same plan in board visibility</field> <field name="model_id" ref="model_gamification_goal"/> <field name="groups" eval="[(4, ref('base.group_user'))]"/> <field name="perm_read" eval="True"/> <field name="perm_write" eval="True"/> <field name="perm_create" eval="False"/> <field name="perm_unlink" eval="False"/> - <field name="domain_force">[('user_id','=',user.id)]</field> + <field name="domain_force">[ + '|', + ('user_id','=',user.id), + '&', + ('plan_id.user_ids','in',user.id), + ('plan_id.visibility_mode','=','board')]</field> </record> <record id="goal_manager_visibility" model="ir.rule"> <field name="name">Manager has all rights on user's goals</field> |