diff options
| author | Nicolas Martinelli <nim@odoo.com> | 2018-01-05 13:55:10 +0100 |
|---|---|---|
| committer | Nicolas Martinelli <nim-odoo@users.noreply.github.com> | 2018-01-09 13:19:33 +0100 |
| commit | 81d1296323fdaeb88c37bde45f7443afd6ebd0ac (patch) | |
| tree | 5bda9cf88bd5e0e8176ffb815533c340aee9cca3 /addons | |
| parent | 4637bdf9bf1fa2644a048d5e586fc1b655a2940e (diff) | |
[FIX] account, stock, website: access rights
1. Create a new user with all the permissions as manager (or at least
Accounting) except Inventory
2. Login and then go to Invoicing --> Settings
3. Do a minor change, save
An access error occurs.
Since the settings of all modules are smartly loaded in v11, it now
implies that a user must have extra manager access rights to be allowed
to save them. We could have kept separate actions for each setting page,
but we would have missed the fun of access errors.
Anyway, security-wise this is not an issue to force the manager groups
since a user with 'Settings' access rights can change his own rights.
It's just very annoying. Or fun.
Complement of aa65a46fc50701f
Fixes #21766
opw-801210
Diffstat (limited to 'addons')
| -rw-r--r-- | addons/account/security/account_security.xml | 4 | ||||
| -rw-r--r-- | addons/stock/models/res_config_settings.py | 2 | ||||
| -rw-r--r-- | addons/website/security/website_security.xml | 4 |
3 files changed, 10 insertions, 0 deletions
diff --git a/addons/account/security/account_security.xml b/addons/account/security/account_security.xml index dabb7946440..c527729765c 100644 --- a/addons/account/security/account_security.xml +++ b/addons/account/security/account_security.xml @@ -23,6 +23,10 @@ <field name="groups_id" eval="[(4, ref('account.group_account_invoice')), (4, ref('account.group_account_manager'))]"/> </record> + <record id="base.group_system" model="res.groups"> + <field name="implied_ids" eval="[(4, ref('account.group_account_manager'))]"/> + </record> + <record id="group_warning_account" model="res.groups"> <field name="name">A warning can be set on a partner (Account)</field> <field name="category_id" ref="base.module_category_hidden"/> diff --git a/addons/stock/models/res_config_settings.py b/addons/stock/models/res_config_settings.py index 79adb8fb349..18de1464119 100644 --- a/addons/stock/models/res_config_settings.py +++ b/addons/stock/models/res_config_settings.py @@ -72,6 +72,8 @@ class ResConfigSettings(models.TransientModel): @api.multi def set_values(self): super(ResConfigSettings, self).set_values() + if not self.user_has_groups('stock.group_stock_manager'): + return self.env['ir.config_parameter'].sudo().set_param('stock.use_propagation_minimum_delta', self.use_propagation_minimum_delta) """ If we are not in multiple locations, we can deactivate the internal operation types of the warehouses, so they won't appear in the dashboard. diff --git a/addons/website/security/website_security.xml b/addons/website/security/website_security.xml index 99264d4e460..6702d0878f1 100644 --- a/addons/website/security/website_security.xml +++ b/addons/website/security/website_security.xml @@ -15,6 +15,10 @@ <field name="groups_id" eval="[(4, ref('group_website_designer'))]"/> </record> + <record id="base.group_system" model="res.groups"> + <field name="implied_ids" eval="[(4, ref('website.group_website_designer'))]"/> + </record> + <record id="website_designer_edit_qweb" model="ir.rule"> <field name="name">website_designer: Manage Website and qWeb view</field> <field name="model_id" ref="base.model_ir_ui_view"/> |