summaryrefslogtreecommitdiff
path: root/addons/event/security/event_security.xml
AgeCommit message (Collapse)Author
2020-08-17[FIX] website_event(_*): improve user flow and experience from frontendstd-odoo
PURPOSE Provide some fixes after internal test deployment of event online features. Notably: user registration flow, various fixes in templates. Also add some unit tests to avoid regressions while working on event features. LINKS Task ID-2169118 odoo/odoo#55967 odoo/enterprise#12438 X-original-commit: e66684b23eebaadc3df7b908427d3d7a83d4f0a0
2020-03-20[IMP] *: remove global field definition in ir rules xmlVictor Feyens
It is a computed field, there is no need to manually set its value.
2019-05-13[IMP] base: Contextualize the multi companyYannick Tivisse
Purpose ======= Allow the user to select the allowed companies for which he wants to see records on top of selecting his current company. It is confusing for users to see the records from the company he is connected to and the records of the children companies. Instead of using the hierarchy of companies to access records across companies, the user can now select (from his set of allowed companies) the companies for which he wants to access records. /!\ This means that the user will interact with records from company A when in company B. Example: a SO has been created and confirmed in A. When in B, I create the invoice from it. Specifications ============== 1/ Deprecate the parent/children hierarchy on the res.company model. The fields are kept on the res.company model to ensure the retro-compatibility, but won't be used accross the standard code anymore. The only functional usage for this mechanism was to allow to see records from several companies by creating a virtual parent company, which will be possible with the new mechanism. 2/ By default, a user will only see the records of the company he is connected to (or records without a company). (It is still editable by the user if needed). For that, put this information in the user context, to allow having different configurations on different browser tabs. Instead of having domains like ['|', ('company_id', '=', False), ('company_id', 'child_of', user.company_id.id)] you'll have something like ['|', ('company_id', '=', False), ('company_id', 'in', company_ids)] Note that the 'company_ids' is a value that is passed in the evaluation context on the record rule, as we already have user, or time. company_ids is a list of the ids of all the enabled companies in the user's context. 3/ Out of the generic improvements brought by this task, this will illustrate issues that could exist since several versions. For example, it should not be possible to create a scrap order for the company A with a package of the company B, or it should not be possible to create an invoice on the company A with payment terms from the company B. Before the version 12.0, it was easy to encounter this kind of issues as the admin was the SUPERUSER_ID. A positive side effect of the fact that the SUPERUSER_ID has become an inactive user was to make it more difficult to introduce mismatch on the records, but haven't solved the issue, as it was still possible to do it with parent companies configuration. Some of these issues have been fixed in this commit, but all the business flows should be re-tested to check if an ir.rule should be introduced (eg: a multi company rule for stock.quand.package), if the company of a record is correctly transfered to another record created from the first record (eg: From a SO, create an invoice and a payment, the company of the sales order should be transfered on the invoice and the payment, even if the company of the sales order is A and I'm logged into the company B with the company A enabled. 4/ Currently, if I click on a button on a notification email (example 'View Task'), I face a traceback if I'm not logged into the company of the record. Now, if you click on a button and if you have access to the record, the correct company will be automatically set. 5/ If I display a kanban view with several records from several companies (and an image), all the images should be displayed. 6/ Currently if you copy paste an url, this will crash if you're not in the correct company. This won't be fixed because it's quite impossible to do it in a clean way. This task brings a workaround. Copy/Paste -> Traceback -> Log into the correct company, re-copy/paste -> Ok. 7/ 2 property methods have been added on the environment to retrieve the company on which the user is logged in and the companies the user enabled, on a specific tab. That way, when creating a record, instead of doing default=lambda self: self.env.user.company_id do default=lambda self: self.env.company_id On the other hand, to retrieve the enabled companies, do companies = self.env.company_ids 8/ Modify the Company Switcher widget to allow to log into another company WITHOUT writing on the res.users (and thus bringing cache invalidation issues and so on). Also allow to enable several companies and see records from several companies, and independantly of the other browser's tabs. 9/ When focusing on a tab, save the current company configuration on the local storage. That way, when doing 'CTRL+T' or a middle click, the context is propagated to the new tab. 10/ Improve the error message in case of multi company access errors. Now, when the user is in debug mode, display the related names of the records and the name of the user who brings the issue. 11/ Remove the context erasing when writing on a res.users This is probably coming from the migration to new API of the base module. The context was not propagated at this moment, which was a common mistake at that time. When migrating the module, probably by using the 'black box' method, as the context was not propagated, it was erased on the new version. This is now an issue because the context (i.e. the enabled companies) was erased when writing on a res.users, leading to tracebacks. See: https://github.com/odoo/odoo/commit/7eab8e26d3d46c53f4be924d6a34e80a66e74960#diff-4c2e738ee8f64f11806c889ea097b5e7R624 12/ Fix the crash manager on redirect warnings. The issue is the following - Create an invoice on a company without a configured CoA. - Set a partner - On the onchange_partner_id, a redirect warning is raised to propose you to configure a CoA - Click on 'Go to the configuration panel' - A generic warning says something like 'Do you want to discard your changes?' - Click on yes, the page refreshes, but not on the redirect action. Now, set correctly the action on the hash, and reload instead. The breadcrumb is lost for example, but you reach the correct action at least. 13/ Introduce a res.group to enable/disable the multi company per tab feature. 14/ To help the users to know which tab is in which company, add the possibility to have a favicon per company. When creating a company, the classical 'O' icon is colored by default in a random color. 15/ Remove the company switcher on the frontend. This was mainly there to allow a user to swicth to the company linked to the website. This behavior is now transparent to the user. If the website A is activated, then the company set on the context is the company of the website. 16/ Deprecated the _company_default_get method on the res.company model. Remove the method _get_company on the res.users model. 17/ Add 'allowed_company_ids' and 'current_company_id' on the pyeval context. You can now use those variables on domains in the views to access directly to the activated company.ies on the current tab. TaskID: 1960971 closes odoo/odoo#32341 Signed-off-by: Yannick Tivisse (yti) <yti@odoo.com>
2019-03-05[IMP] base,*: Reorganize access rights groupsjbm-odoo
Purpose ======= Access group terminology is missleading. Yous have to be manager to administrate an application. This task consists to rename groups to be understandable for everyone. Groups should be reorganised on the users form to be more explicit. Specification ============= 1/ Rename 'Manager' to 'Administrator' in users groups. 2/ Define a hierarchy on access groups by using the category_id in the manifests A category 'Operations/Project' will create a category Project with a parent category 'Operations', and something smart is already developed (in modules/db.py) to avoid duplicating categories. 3/ Add a group in expenses to be able to approve expenses reports for my team. 4/ Add a group in timesheets to be able to approve timesheets for my team. 5/ Remove partially the useless crap in ir_module_category_data.xml 6/ Sort access rights groups on users form according to its parent category closes odoo/odoo#29362 Signed-off-by: "Yannick Tivisse (yti)" <yti@odoo.com>
2018-08-23[IMP] base: add regular user admin as uid 2Raphael Collet
User 1 simply becomes a technical user (inactive, no password).
2018-06-26[FIX] event, event_sale, website_event: allow portal access to own registrationsLucas Perais (lpe)
OPW 1859364
2017-03-03[IMP] event: apply various usability improvementsMitali Patel
* reporting: remove report.event.registration as it can be replaced by pivot and graph views on event.registration model directly. The custom SQL view does not add any valuable information; * event: correctly take limitations from event category and check minimum seats is lesser or equal to maximum seats; * event: reorganize a bit the form view * avoid some kind of random ordering of buttons; * move seats availability directly in the form view; * ticket page is now used only for ticketing purpose, not a mismatch with seats; * registration: attendees can be set as done only for confirmed events to avoid confusion when working with draft events; Misc usability * event.type: rename event type to event category to have a unified term across various event addons; * event: stop tracking active field as it does not add interesting information; it should not toggle everyday; * event: track location as it does add valuable information; * event: rename some labels to ease user experience; * event.mail: add missing description and rec name;
2016-09-28[REF] website, *: review website access rightsqsm-odoo
* event, website_event, website_forum, * website_hr_recruitment, website_sale Website access rights were buggy. The editor assets and website editor assets have to be loaded together to work so the previous behavior which only loaded one with the restricted access right was not right. Also, people which had the "Manager" access right for model like event or job only got access to creation and edition of those objects if they had the full access to website access rights. Now the website module creates the two same groups : * group_website_publisher: load all editor assets, give access to page creation for model the user has access (event, job, ...) and edition of those pages * group_website_designer: implies the first one and give access in creation and edition of all pages + access of all website menus The manager access rights for event, product, jobs, etc now implies the group_website_publisher group for the user (so that the manager have the editor assets and editor ui). Note: some python codes use the group_website_publisher for no right reason, this has to be adapted.
2016-08-23[IMP] base_setup: Allow the admin to modify the default user acess rightsYannick Tivisse
Add a link in the general settings to access easily the default_user form view in order to modify the default access rights The default_user manager rights declarations in all the applications have been move in a noupdate="1" definition to avoid the manual configuration overwrittings
2016-08-19[REF] event: remove group_mail_scheduling as email scheduling is part of ↵Thibault Delavallée
event management In the interface using the email scheduler of events is limited to a group that is not activated by default. However by default emails are sent and therefore cannot be configured by the event maanger. As managers should always be able to configure sent emails we decided to remove the group and always give access to the email scheduling tab of the event form view.
2016-08-10[REF] various: rename openerp node to odoo in xml filesThibault Delavallée
2016-05-13[IMP] event: change term 'Subscription' to 'Registration'dut-odoo
Changed term 'subscription' to 'registration' in event, event_sale, website_event, website_event_sale modules
2015-11-20[IMP] Newly created users get all manager access rightYannick Tivisse
Coming from a bug in web_settings_dashboard. Invited user didn't have any rights when created from the dashboard, which was leading to an error. This bug leaded to a new discussion. Better to have basic employee having user rights for all main applications. For bigger entreprises there is an admin that will carefully remove extra rights, if necessary. The target is small businesses, it makes sense that every way to create a user gives the same result. In conclusion, each new user has a full access to the applications by default How is it implemented ? We added an inactive default user which original access right to the groups 'base.group_user' and 'base.group_partner_manager' in base. Each application will extend the default user's access right by adding the maximal access right for this application. On user creation, we will use by default the 'group_id' field from the default user. We will in the same time remove the ugly 'default_groups_ref' key which was passed sometimes in the context for some fields in some views, and sometimes nothing. So, the user can modify the access rights for the default user, but he should be aware that removing project user access rights for a default user will prevent a *created on the fly in a task* user will not be able to access the task.
2015-08-12[IMP] event: groups and config updateGaurav Panchal
Move the module category declaration in base to fit the other categories declaration. Use event groups instead of marketing groups.
2015-04-28[FIX] event: unused group added at 581c2f1aa1e321d96d10a0b4e1f1289bc299b7a2Richard Mathot
2015-04-22[IMP] event: usability improvementsYannick Tivisse
- New filter "not cancelled" for attendees management - No more readonly nor invisibility on "minimum number of seats" - Event questions and mail scheduling have been put under an optional tab
2013-06-26[MERGE]sync with trunksgo@tinyerp.com
bzr revid: sgo@tinyerp.com-20130626111029-e6szwugpewn3cd2g
2013-04-10[REF] event: visibility moved from portal_event to event. Customized rules, ↵Thibault Delavallée
removed now unnecessary files. bzr revid: tde@openerp.com-20130410125117-m9ir36qhkp9fqax1
2013-02-22[IMP] remove access rights in mail,crm,eventForam Katharotiya (OpenERP)
bzr revid: fka@tinyerp.com-20130222072757-0fain23pzyb8dzk9
2012-12-19[MERGE] Harmonization of noupdate flag on security XML data, courtesy of ↵Olivier Dony
Alexis de Lattre (Akretion) ir.rule records are in noupdate data blocks to let the admin alter them without fear of them being reset at next update. Other records such as groups are in normal mode, so they can be updated whenever necessary bzr revid: odo@openerp.com-20121218232001-t425t4hi7qbmsip2
2012-09-19[IMP]User : Access rights in changed menu nameHardik
bzr revid: hsa@tinyerp.com-20120919085103-mmen7f0vzqvmp9bx
2012-07-25[IMP] identation, also remove useless 'noupdate=0' attributeAntonin Bourguignon
bzr revid: abo@openerp.com-20120725144039-o3kjxo065qhode33
2012-07-13Harmonize the noupdate flag on security XML files :Alexis de Lattre
- ir.rule objects are noupdate="1" - all other objects are noupdate="0" bzr revid: alexis@via.ecp.fr-20120713170838-pjsysliyt6twazrc
2012-06-28[IMP]remove tabs and add spaces instead of themSanjay Gohel (Open ERP)
bzr revid: sgo@tinyerp.com-20120628064005-zuerrpazumf5lf1q
2012-04-04[IMP] groups: remove auto-inclusion of admin in groups, and make the ↵Raphael Collet
inclusion explicit in groups bzr revid: rco@openerp.com-20120404090830-nteimn2kvz8nkk7h
2012-03-29[FIX] event: fixed the access rights in order to have that being in the ↵Quentin (OpenERP)
manager group implies being in the user group too bzr revid: qdp-launchpad@openerp.com-20120329085703-419271p8s81cl6zo
2012-03-26[IMP]add share access to registration and changes in security viewSanjay Gohel (Open ERP)
bzr revid: sgo@tinyerp.com-20120326124825-xewmd0qc82k9hk11
2012-03-01[REF] event: removed useless TODO statementQuentin (OpenERP)
bzr revid: qdp-launchpad@openerp.com-20120301114523-8rrplgaojxhwdn51
2012-02-24[ADD] event: added security fileQuentin (OpenERP)
bzr revid: qdp-launchpad@openerp.com-20120224133302-w3fr4nxju54zs4nh
2011-12-12[IMP] base_contact, event, knowledge, product, project, sale_mrp: avoid ↵Raphael Collet
redefinition of sale groups bzr revid: rco@openerp.com-20111212145128-zx64v0uwf8n0lwyu
2011-12-12[IMP] base_contact, crm, document, event: add group categoriesRaphael Collet
bzr revid: rco@openerp.com-20111212134354-49p2gyf93qozplll
2011-08-02add group implicationsRaphael Collet
bzr revid: rco@openerp.com-20110802130811-pkdmw43ufifz0tpj
2010-11-19[IMP]: Moved reference of demo user from *_security.xml to demo filerpa (Open ERP)
bzr revid: rpa@tinyerp.com-20101119102525-8gyj1gmm1w29rwxu
2010-11-14[FIX] correct regression on intalling module without demo dataHarry (OpenERP)
bzr revid: hmo@tinyerp.com-20101114134821-7djwpr6nmmxu584q
2010-11-01[IMP] account,hr,sale,point_of_sale,event: give user role to the demo uservth
bzr revid: vth@tinyerp.com-20101101124606-ia3nqngu19u8b7oa
2010-10-16[IMP] access rights cleaningFabien Pinckaers
bzr revid: fp@tinyerp.com-20101016164709-8w551aaosqx0dufu
2010-10-08[IMP] event: Improve search view and small change in Make invoice wizardpsi (Open ERP)
bzr revid: psi@tinyerp.co.in-20101008105948-1qflslhcp1qla6qo
2010-08-09[MOD] Group name changed , Sales / Salesman to Sales / UserVir (Open ERP)
bzr revid: vir@tinyerp.com-20100809060226-jx6plkn6mafiplyz
2010-08-06[MOD] event: usability improvement in access rightsAMP (OpenERP)
bzr revid: amp@tinyerp.com-20100806135358-yapv8rqd34ac6oms
2010-07-30[MOD] usability improvement and changes in access rightsAMP (OpenERP)
bzr revid: amp@tinyerp.com-20100730130247-1hvssj5z0f9gvd3a
2010-07-29[MOD] usability improvement in access rightsAMP (OpenERP)
bzr revid: amp@tinyerp.com-20100729133057-gdhqqohzpkdnq8vl
2010-07-16[IMP] event: demo dataHarry (OpenERP)
bzr revid: hmo@tinyerp.com-20100716081957-0gnd1eilovf01sbf
2010-07-16[IMP] Event: cleanHarry (OpenERP)
bzr revid: hmo@tinyerp.com-20100716064714-ivuu3ux3sayo28fh
2010-06-26[REF+IMP] event, membership:Mod2 Team (OpenERP)
Event : * Change button icon for all searchview. * Develop 'group by partner' functionality in make invoice wizard of registration form. * change yaml as per changes in make invoice wizard. * remove 'List of register event' wizard and put link on in event form. * ADD 'Send a new mail' button for mail * Improve history functionality. * add group : event/manager and event/subscriber. Membership . * merge two sql query in one repor_membership file. * develop search view of that report. * change icon for search view. bzr revid: hmo@tinyerp.com-20100626101340-bt77wjb8ug3a3flj
2010-06-22[ADD]: event: add new group event/manager, event/subscriber.atp (Open ERP)
bzr revid: atp@tinyerp.co.in-20100622110023-5w6fnbtiwqyq7f6u
2010-06-07[IMP]: event: use inherit in place of inherits.Improve report using report ↵atp (Open ERP)
guidlines. bzr revid: atp@tinyerp.co.in-20100607064312-3cl1vc0gfal7wvhe
2010-05-17[IMP, FIX]: event: Improvement in event modules for:rpa (Open ERP)
* Removed dependency on crm.case as it is removed * Fixes in event/registration computation as per ner changes * Improvement in wizard bzr revid: rpa@tinyerp.com-20100517133114-jjp82khn32m5zvjr
2008-10-24fix access rightsChristophe Simonis
bzr revid: christophe@tinyerp.com-20081024070849-cjjlrvz52t67ll0m