diff options
| author | Sébastien Theys <seb@odoo.com> | 2018-07-20 12:02:16 +0000 |
|---|---|---|
| committer | Thibault Delavallée <tde@odoo.com> | 2018-12-12 12:44:03 +0000 |
| commit | b9c8ba83e6b367275eca28255dd7df9b8ac84aa1 (patch) | |
| tree | 388eb2d542849b73e1980b0483cf5ca426576192 /addons/mail/static/src | |
| parent | 13eb9b9c5b77cb42616f91dc4db48e0a6aab014e (diff) | |
[IMP] mail: clean activities access rights
This commit improves code of access rights checks when creating or updating
activities. Several points triggers this commit
* we would like to use _filter_access_rules and override it on activities
model in order to be more standard;
* we would like to get rid of sudo used in various CRUD overrides as using
standard ORM method allows to correctly use current user;
* we would like to get rid of create_user_id field once we can keep the
current user as create_uid;
Access rights are a bit updated. They are now the following
* you can create activities for documents like posting messages (using
_mail_post_access attribute; if not defined, write access on document
is required);
* you can read activities for documents you can read;
* you can write and unlink activities either following the defined access
rule (created OR assigned), and otherwise like posting messages (
using _mail_post_access attribute; if not defined, write access on
document is required);
In this commit we also hide edit / mark as done / cancel buttons for
activities the current user cannot modify.
This commit is linked to task ID 1856417 and PR #27619.
Co-Authored-By: Sébastien Theys <seb@odoo.com>
Co-Authored-By: Thibault Delavallée <tde@odoo.com>
Diffstat (limited to 'addons/mail/static/src')
| -rw-r--r-- | addons/mail/static/src/xml/activity.xml | 2 | ||||
| -rw-r--r-- | addons/mail/static/src/xml/web_kanban_activity.xml | 4 |
2 files changed, 3 insertions, 3 deletions
diff --git a/addons/mail/static/src/xml/activity.xml b/addons/mail/static/src/xml/activity.xml index cb7f8a5ae28..80618f7024c 100644 --- a/addons/mail/static/src/xml/activity.xml +++ b/addons/mail/static/src/xml/activity.xml @@ -74,7 +74,7 @@ </t> </div> </t> - <div class="o_thread_message_tools btn-group"> + <div t-if="activity.can_write" class="o_thread_message_tools btn-group"> <span class="o_mark_as_done" data-toggle="popover" t-att-data-activity-id="activity.id" t-att-data-force-next-activity="activity.force_next" t-att-data-previous-activity-type-id="activity.activity_type_id[0]"> <a role="button" href="#" class="btn btn-link btn-success text-muted o_activity_link mr8"> <i class="fa fa-check"/> Mark Done </a> diff --git a/addons/mail/static/src/xml/web_kanban_activity.xml b/addons/mail/static/src/xml/web_kanban_activity.xml index 8f63b51cdfe..9ebed7ebce4 100644 --- a/addons/mail/static/src/xml/web_kanban_activity.xml +++ b/addons/mail/static/src/xml/web_kanban_activity.xml @@ -40,7 +40,7 @@ <div t-attf-class="o_activity_title_entry {{! log.force_next ? 'align-items-center' : 'mb-1'}}"> <span t-attf-class="fa #{log.icon ? log.icon : 'fa-bell' } fa-fw mr-2 text-center text-muted" role="img" aria-label="Log" title="Log"/> <strong class="text-dark"><t t-esc="log.title_action or log.activity_type_id[1]"/></strong> - <button t-if="! log.force_next" class="btn btn-sm btn-link py-0 o_edit_button"><i class="fa fa-pencil"/></button> + <button t-if="! log.force_next and log.can_write" class="btn btn-sm btn-link py-0 o_edit_button"><i class="fa fa-pencil"/></button> </div> <div class="o_activity_title_entry mt-1" t-if="log.state != 'today'"> <span class="fa fa-clock-o fa-fw mr-2 text-center text-muted" role="img" aria-label="Deadline" title="Deadline"/> @@ -62,7 +62,7 @@ <span><t t-esc="log.user_id[1]" /></span> </div> </div> - <div class="flex-grow-1 text-right"> + <div t-if="log.can_write" class="flex-grow-1 text-right"> <a t-att-data-force-next-activity="log.force_next" t-att-data-previous-activity-type-id="log.activity_type_id[0]" t-att-data-activity-id="log.id" |