diff options
| author | Martin Trigaux <mat@openerp.com> | 2014-09-16 15:27:56 +0200 |
|---|---|---|
| committer | Martin Trigaux <mat@openerp.com> | 2014-09-16 16:44:42 +0200 |
| commit | d99835ee9c5adcce99abe41363316b63cfb29404 (patch) | |
| tree | 5b926e714014173773e064322b1d7e100d697026 /addons/payment/security | |
| parent | 685fa26e83e6358fcaa786b6e0358bd8b1e155f3 (diff) | |
[FIX] payment: access rights limitation
Do not allow everybody to access account.transactions.
Restrict by default to readonly and even restrict the access with a record rule, give access to salesman.
Diffstat (limited to 'addons/payment/security')
| -rw-r--r-- | addons/payment/security/ir.model.access.csv | 2 | ||||
| -rw-r--r-- | addons/payment/security/payment_security.xml | 24 |
2 files changed, 25 insertions, 1 deletions
diff --git a/addons/payment/security/ir.model.access.csv b/addons/payment/security/ir.model.access.csv index 18f98939472..f52f9a44d4e 100644 --- a/addons/payment/security/ir.model.access.csv +++ b/addons/payment/security/ir.model.access.csv @@ -2,6 +2,6 @@ id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink payment_acquirer_all,payment.acquirer.all,model_payment_acquirer,,1,0,0,0 payment_acquirer_user,payment.acquirer.user,model_payment_acquirer,base.group_user,1,1,1,0 payment_acquirer_system,payment.acquirer.system,model_payment_acquirer,base.group_system,1,1,1,1 -payment_transaction_all,payment.transaction.all,model_payment_transaction,,1,1,1,0 +payment_transaction_all,payment.transaction.all,model_payment_transaction,,1,0,0,0 payment_transaction_user,payment.transaction.user,model_payment_transaction,base.group_user,1,1,1,0 payment_transaction_system,payment.transaction.system,model_payment_transaction,base.group_system,1,1,1,1
\ No newline at end of file diff --git a/addons/payment/security/payment_security.xml b/addons/payment/security/payment_security.xml new file mode 100644 index 00000000000..8fb4def2811 --- /dev/null +++ b/addons/payment/security/payment_security.xml @@ -0,0 +1,24 @@ +<?xml version="1.0" encoding="utf-8"?> +<openerp> + <data noupdate="1"> + + <record id="payment_transaction_user_rule" model="ir.rule"> + <field name="name">Access own payment transaction only</field> + <field name="model_id" ref="payment.model_payment_transaction"/> + <field name="domain_force">[ + '|', + ('partner_id','=',False), + ('partner_id','=',user.partner_id.id) + ]</field> + <field name="groups" eval="[(4, ref('base.group_user')), (4, ref('base.group_portal'))]"/> + </record> + + <record id="payment_transaction_salesman_rule" model="ir.rule"> + <field name="name">Access every payment transaction</field> + <field name="model_id" ref="payment.model_payment_transaction"/> + <field name="domain_force">[(1, '=', 1)]</field> + <field name="groups" eval="[(4, ref('base.group_sale_salesman'))]"/> + </record> + + </data> +</openerp> |