summaryrefslogtreecommitdiff
path: root/addons/analytic/security/analytic_security.xml
AgeCommit message (Collapse)Author
2019-05-13[IMP] base: Contextualize the multi companyYannick Tivisse
Purpose ======= Allow the user to select the allowed companies for which he wants to see records on top of selecting his current company. It is confusing for users to see the records from the company he is connected to and the records of the children companies. Instead of using the hierarchy of companies to access records across companies, the user can now select (from his set of allowed companies) the companies for which he wants to access records. /!\ This means that the user will interact with records from company A when in company B. Example: a SO has been created and confirmed in A. When in B, I create the invoice from it. Specifications ============== 1/ Deprecate the parent/children hierarchy on the res.company model. The fields are kept on the res.company model to ensure the retro-compatibility, but won't be used accross the standard code anymore. The only functional usage for this mechanism was to allow to see records from several companies by creating a virtual parent company, which will be possible with the new mechanism. 2/ By default, a user will only see the records of the company he is connected to (or records without a company). (It is still editable by the user if needed). For that, put this information in the user context, to allow having different configurations on different browser tabs. Instead of having domains like ['|', ('company_id', '=', False), ('company_id', 'child_of', user.company_id.id)] you'll have something like ['|', ('company_id', '=', False), ('company_id', 'in', company_ids)] Note that the 'company_ids' is a value that is passed in the evaluation context on the record rule, as we already have user, or time. company_ids is a list of the ids of all the enabled companies in the user's context. 3/ Out of the generic improvements brought by this task, this will illustrate issues that could exist since several versions. For example, it should not be possible to create a scrap order for the company A with a package of the company B, or it should not be possible to create an invoice on the company A with payment terms from the company B. Before the version 12.0, it was easy to encounter this kind of issues as the admin was the SUPERUSER_ID. A positive side effect of the fact that the SUPERUSER_ID has become an inactive user was to make it more difficult to introduce mismatch on the records, but haven't solved the issue, as it was still possible to do it with parent companies configuration. Some of these issues have been fixed in this commit, but all the business flows should be re-tested to check if an ir.rule should be introduced (eg: a multi company rule for stock.quand.package), if the company of a record is correctly transfered to another record created from the first record (eg: From a SO, create an invoice and a payment, the company of the sales order should be transfered on the invoice and the payment, even if the company of the sales order is A and I'm logged into the company B with the company A enabled. 4/ Currently, if I click on a button on a notification email (example 'View Task'), I face a traceback if I'm not logged into the company of the record. Now, if you click on a button and if you have access to the record, the correct company will be automatically set. 5/ If I display a kanban view with several records from several companies (and an image), all the images should be displayed. 6/ Currently if you copy paste an url, this will crash if you're not in the correct company. This won't be fixed because it's quite impossible to do it in a clean way. This task brings a workaround. Copy/Paste -> Traceback -> Log into the correct company, re-copy/paste -> Ok. 7/ 2 property methods have been added on the environment to retrieve the company on which the user is logged in and the companies the user enabled, on a specific tab. That way, when creating a record, instead of doing default=lambda self: self.env.user.company_id do default=lambda self: self.env.company_id On the other hand, to retrieve the enabled companies, do companies = self.env.company_ids 8/ Modify the Company Switcher widget to allow to log into another company WITHOUT writing on the res.users (and thus bringing cache invalidation issues and so on). Also allow to enable several companies and see records from several companies, and independantly of the other browser's tabs. 9/ When focusing on a tab, save the current company configuration on the local storage. That way, when doing 'CTRL+T' or a middle click, the context is propagated to the new tab. 10/ Improve the error message in case of multi company access errors. Now, when the user is in debug mode, display the related names of the records and the name of the user who brings the issue. 11/ Remove the context erasing when writing on a res.users This is probably coming from the migration to new API of the base module. The context was not propagated at this moment, which was a common mistake at that time. When migrating the module, probably by using the 'black box' method, as the context was not propagated, it was erased on the new version. This is now an issue because the context (i.e. the enabled companies) was erased when writing on a res.users, leading to tracebacks. See: https://github.com/odoo/odoo/commit/7eab8e26d3d46c53f4be924d6a34e80a66e74960#diff-4c2e738ee8f64f11806c889ea097b5e7R624 12/ Fix the crash manager on redirect warnings. The issue is the following - Create an invoice on a company without a configured CoA. - Set a partner - On the onchange_partner_id, a redirect warning is raised to propose you to configure a CoA - Click on 'Go to the configuration panel' - A generic warning says something like 'Do you want to discard your changes?' - Click on yes, the page refreshes, but not on the redirect action. Now, set correctly the action on the hash, and reload instead. The breadcrumb is lost for example, but you reach the correct action at least. 13/ Introduce a res.group to enable/disable the multi company per tab feature. 14/ To help the users to know which tab is in which company, add the possibility to have a favicon per company. When creating a company, the classical 'O' icon is colored by default in a random color. 15/ Remove the company switcher on the frontend. This was mainly there to allow a user to swicth to the company linked to the website. This behavior is now transparent to the user. If the website A is activated, then the company set on the context is the company of the website. 16/ Deprecated the _company_default_get method on the res.company model. Remove the method _get_company on the res.users model. 17/ Add 'allowed_company_ids' and 'current_company_id' on the pyeval context. You can now use those variables on domains in the views to access directly to the activated company.ies on the current tab. TaskID: 1960971 closes odoo/odoo#32341 Signed-off-by: Yannick Tivisse (yti) <yti@odoo.com>
2018-09-10Revert "[IMP] base: Remove unused module categories"Yannick Tivisse
This reverts commit 382fbd35204ff947c16b795ca090c97d6741fb1d.
2018-04-26[IMP] base: Remove unused module categoriesYannick Tivisse
The categories other extra rigths and hidden are not used now.
2018-01-31[IMP] analytic: in-depth refactoringJoren Van Onder
* analytic accounts can be shared among companies * amount on analytic lines always refer to amount in company currency of which it belongs to * add analytic groups (hierarchical way to classify analytic accounts) * analytic tags: - only present on analytic lines, not anymore on analytic accounts - can be used to distribue/split an analytic lines among several analytic accounts - enabled by a dedicated res.group - added on several objects (vouchers, expenses, analytic defaults...) as well as in bank statement reconciliation widget (manual counterpart and account.reconcile.model) * bunch of fixes made related to analytic Was PR #22124. Was task 32386. Original work by tbe.
2016-08-10[REF] various: rename openerp node to odoo in xml filesThibault Delavallée
2015-08-27[IMP] analytic: adaptation due to the new Sale moduleNicolas Martinelli
Major changes: - Remove reports - Simplify models Reason: complete rewrite of the Sale module. Responsible: fp, dbo, nim
2014-08-04[MOVE] account: moved account/project files to analytic or account, ↵cod-odoo
depending on which module the moved code belongs to. This allows to remove references to project in account module. Also added some improvements in project when deleting a project (delete account if void) or when deleting an account (delete project if void).
2013-04-29[REM] bunch of nonsensical @model + @refXavier Morel
bzr revid: xmo@openerp.com-20130429124333-p1h11fpy04y3sljy
2012-07-13Harmonize the noupdate flag on security XML files :Alexis de Lattre
- ir.rule objects are noupdate="1" - all other objects are noupdate="0" bzr revid: alexis@via.ecp.fr-20120713170838-pjsysliyt6twazrc
2012-04-26[IMP] Rename Budgets Management to Budget Management in account config ↵Jagdish Panchal (Open ERP)
wizard, change depends of account_accountant module and put Analytic Accounting group from Usability to Hidden group in user form bzr revid: jap@tinyerp.com-20120426102942-gkyl87lp6gpfq53x
2012-04-04[IMP] groups: remove auto-inclusion of admin in groups, and make the ↵Raphael Collet
inclusion explicit in groups bzr revid: rco@openerp.com-20120404090830-nteimn2kvz8nkk7h
2011-12-12[IMP] account, analytic, auction: add group categoriesRaphael Collet
bzr revid: rco@openerp.com-20111212133523-ea0r5b47mc5tddl7
2011-06-08[FIX] analytic,hr,hr_evaluation,hr_expense,hr_recruitment: added ↵mtr
multi-company access rules lp bug: https://launchpad.net/bugs/788139 fixed bzr revid: mtr@mtr-20110608072935-blig6ejq1oa36un5
2011-02-28[REVERT] all: revert incorrect change of default ir.rules for multi-companyOlivier Dony
By default only records belonging to the user's company or descendant companies should be visible. The original patch introduced visibility of records from ancestor companies, which should be suited only for a few cases, such as res.patner. Original revision: 3164.24.175 sbh@tinyerp.com-20101223095216-n6psmzicdcs8is8x lp bug: https://launchpad.net/bugs/720175 fixed bzr revid: odo@openerp.com-20110228135754-6skiy4fb9dg54xb6
2010-12-23[Fix] : correct security rule of company_idSbh (OpenERP)
bzr revid: sbh@tinyerp.com-20101223095216-n6psmzicdcs8is8x
2010-10-18[IMP] ir.rule reviewedFabien Pinckaers
bzr revid: fp@tinyerp.com-20101018092840-7a6wv2vw2s6a1a2s
2010-10-09[IMP] better useabilityFabien Pinckaers
bzr revid: fp@tinyerp.com-20101009160143-rrcfgoyudey22zv4
2010-09-13[IMP] analytic: better name for ir.ruleqdp-launchpad@tinyerp.com
bzr revid: qdp-launchpad@tinyerp.com-20100913152323-z9s377w2d39toeiq
2010-09-03[ADD] Analytic: added Analytic group on analytic account and put that group ↵pap (openerp)
on menus related to analytic accounting, removed access rules for anaytic accounting bzr revid: pap@tinyerp.co.in-20100903124403-o1gbrd38nc047vhx
2010-09-01[ADD] Account: added groups on analytic accounting and added access rights ↵pap (openerp)
for it bzr revid: pap@tinyerp.co.in-20100901073017-w54ys7g3v1qzr7tp
2010-08-20[ADD] account, account_payment, analytic: added company related record rules ↵vra
for some objects and also added company field. bzr revid: vra@tinyerp.com-20100820113218-5xg58scsgjavb6fg