diff options
| author | Martin Trigaux <mat@openerp.com> | 2014-09-16 15:27:56 +0200 |
|---|---|---|
| committer | Martin Trigaux <mat@openerp.com> | 2014-09-16 16:44:42 +0200 |
| commit | d99835ee9c5adcce99abe41363316b63cfb29404 (patch) | |
| tree | 5b926e714014173773e064322b1d7e100d697026 /addons/payment/security/payment_security.xml | |
| parent | 685fa26e83e6358fcaa786b6e0358bd8b1e155f3 (diff) | |
[FIX] payment: access rights limitation
Do not allow everybody to access account.transactions.
Restrict by default to readonly and even restrict the access with a record rule, give access to salesman.
Diffstat (limited to 'addons/payment/security/payment_security.xml')
| -rw-r--r-- | addons/payment/security/payment_security.xml | 24 |
1 files changed, 24 insertions, 0 deletions
diff --git a/addons/payment/security/payment_security.xml b/addons/payment/security/payment_security.xml new file mode 100644 index 00000000000..8fb4def2811 --- /dev/null +++ b/addons/payment/security/payment_security.xml @@ -0,0 +1,24 @@ +<?xml version="1.0" encoding="utf-8"?> +<openerp> + <data noupdate="1"> + + <record id="payment_transaction_user_rule" model="ir.rule"> + <field name="name">Access own payment transaction only</field> + <field name="model_id" ref="payment.model_payment_transaction"/> + <field name="domain_force">[ + '|', + ('partner_id','=',False), + ('partner_id','=',user.partner_id.id) + ]</field> + <field name="groups" eval="[(4, ref('base.group_user')), (4, ref('base.group_portal'))]"/> + </record> + + <record id="payment_transaction_salesman_rule" model="ir.rule"> + <field name="name">Access every payment transaction</field> + <field name="model_id" ref="payment.model_payment_transaction"/> + <field name="domain_force">[(1, '=', 1)]</field> + <field name="groups" eval="[(4, ref('base.group_sale_salesman'))]"/> + </record> + + </data> +</openerp> |