diff options
| author | Nicolas Martinelli <nim@odoo.com> | 2017-01-18 13:31:02 +0100 |
|---|---|---|
| committer | Nicolas Martinelli <nim@odoo.com> | 2017-01-18 14:49:22 +0100 |
| commit | 23b2bba925c6bf2aac37c49bd2bdb3463f47e8a6 (patch) | |
| tree | b855cd948298b81882d4073914e57db87d373c87 /addons | |
| parent | f98a4d45af6088fc8a4e3268f3c92c57de51cdd0 (diff) | |
[FIX] calendar: private events
By default, an event can be modified by any employee. This is also the
case for private events, displayed as "Busy" to other users. However,
since any user can modify an event, nothing prevents him to change the
privacy setting in order to be able to see the content.
This commit introduces a global record rule which only allows the
followers of an event to modify it.
opw-705079
Diffstat (limited to 'addons')
| -rw-r--r-- | addons/calendar/security/calendar_security.xml | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/addons/calendar/security/calendar_security.xml b/addons/calendar/security/calendar_security.xml index 80eb79553a0..4636ec94bc8 100644 --- a/addons/calendar/security/calendar_security.xml +++ b/addons/calendar/security/calendar_security.xml @@ -23,5 +23,15 @@ <field name="groups" eval="[(4, ref('base.group_portal'))]"/> </record> + <record id="calendar_event_rule_private" model="ir.rule"> + <field ref="model_calendar_event" name="model_id"/> + <field name="name">Private events</field> + <field name="domain_force">['|', ('class', '!=', 'private'), '&', ('class', '=', 'private'), ('partner_ids', 'in', user.partner_id.id)]</field> + <field name="perm_read" eval="False"/> + <field name="perm_write" eval="True"/> + <field name="perm_create" eval="True"/> + <field name="perm_unlink" eval="True"/> + </record> + </data> </openerp> |