summaryrefslogtreecommitdiff
path: root/addons/mail/security/mail_security.xml
AgeCommit message (Collapse)Author
2018-12-12[REF] mail: remove create_user_id field on activityThibault Delavallée
As activities are created using the current user there is no need anymore to have another field to store the activity creator. We can therefore remove create_user_id and replace its use by the magic create_uid field. This commit is linked to task ID 1856417 and PR #27619.
2018-12-12[IMP] mail: clean activities access rightsSébastien Theys
This commit improves code of access rights checks when creating or updating activities. Several points triggers this commit * we would like to use _filter_access_rules and override it on activities model in order to be more standard; * we would like to get rid of sudo used in various CRUD overrides as using standard ORM method allows to correctly use current user; * we would like to get rid of create_user_id field once we can keep the current user as create_uid; Access rights are a bit updated. They are now the following * you can create activities for documents like posting messages (using _mail_post_access attribute; if not defined, write access on document is required); * you can read activities for documents you can read; * you can write and unlink activities either following the defined access rule (created OR assigned), and otherwise like posting messages ( using _mail_post_access attribute; if not defined, write access on document is required); In this commit we also hide edit / mark as done / cancel buttons for activities the current user cannot modify. This commit is linked to task ID 1856417 and PR #27619. Co-Authored-By: Sébastien Theys <seb@odoo.com> Co-Authored-By: Thibault Delavallée <tde@odoo.com>
2018-09-17[IMP] hr,mail: auto-subscribe departments to channelsGert Pellin
Purpose of this commit is to allow to make private channels linked to an HR department with an auto subscription. It will ease the use of discussion channels among employees of a given department. Moreover auto subscription is useful to avoid having to manually synchronize channel members and department members. This commit is linked to task ID 1848526 and closes PR #26650 . Co-authored-by: Gert Pellin <gpe@odoo.com> Co-authored-by: Richard Mathot <rim@odoo.com>
2018-06-06[IMP] mail: add moderation on channelsMathieu Duckaerts-Antoine
Purpose of this commit is to allow moderation on incoming messages in discussion channels. On some channels on which moderation is required messages should be in a pending moderation stage. Moderators can accept or refuse messages as well as always allow or ban messages coming from a given set of emails. Channels now have an option to be moderated. Moderators can be added on channels. They have access to a specific UI in Discuss to see and take action on messages waiting for moderation. Concerning mail.thread message that are pending moderation are not notified. It means nobody receives a notification about them. Moderation process calls the notification once the message is validated. Various features included in this commit : * a model is added to store the decision about emails, allow or ban; * access rights are updated so that only moderators can modify moderation fields on message; * specific bus notifications are send to moderated people as well as to moderators on incoming emails as well as when a decision is taken; * options are added on channels to send explanations to moderated emails; * options are added on channels to write and send guidelines explaining why and how moderation is performed; * a reminder is send daily to moderators with remaining messages to moderate; * discuss UI is adapted and a new channel is added below Inbox and Starred giving access to moderation tools; * chanenl UI is adapted allowing to moderate directly inside channels; This commit is linked to task ID 29521. Closes #21921.
2017-11-08[FIX] mail: ease activities management through documentsThibault Delavallée
This commit improve the daily use of activities by delegating activities management to the document. Activities are already managed on document through the UI either in form view or in kanban view.
2016-09-14[FIX] mail: restrict write access rights of portal users to their own ↵Thibault Delavallée
follower and notification entries
2016-09-01[IMP] mail: improve notification management for customersThibault Delavallée
Currently it is impossible in Discuss to know whether an email has been sent to a customer and whether it failed or bounced. A notified partner has an entry in the needaction m2m table. In this commit we decorate this table to add fields about the email notification: is an email sent, did it failed, did it bounce. This information is kept only for customers. Internal users does not use this information. Moreover their notification is deleted once the message is read in the Chatter. This avoids having a notification table that grows quickly. Chatter now holds a new icon for email details. It allows to know on a thread status of emails sent to customers.
2016-08-10[REF] various: rename openerp node to odoo in xml filesThibault Delavallée
2015-08-28[IMP] base: make group "Technical Features" effective in debug mode onlyAjay Javiya
In method `user_has_groups`, make "Technical Features" effective in debug mode. Make the group "Employees" inherit "Technical Features". Make the group "Technical Features" invisible in the user form view. Remove useless `ir.rule` attached on group "Technical Features". Fix `test_acl` by avoiding the tricks around the group "Technical Features".
2015-08-21[REF] mail: model update for NewChatterThibault Delavallée
Main changes : - mail.notification model is removed. People do not receive notifications anymore. Instead two ways of following documents exist - using a channel; messages will be displayed on the channel itself in a near future commit - following with its partner; messages will all be considered as needaction, using a new m2m table. People should receive less needaction messages by following less records by themselves. There is no more read / unread state anymore. Instead only needaction messages are considered. Todo (Favorites) messages still exist, and are stores on a new m2m table instead of using decorated notifciations. - the main filter for documents is not message_unread anymore, but message_needaction. A lot of views and filters have been updated accordingly. - the vote feature has been removed
2015-08-21[REF] mail: mail_channel updateThibault Delavallée
Some features from live_chat have been moved to the mail module : - channels now have members, replacing followers; - a decorated m2m is used to link channels and members. It stores the last seen message on the channel for a specific partner; - channels do not create menu entries anymore, because the NewChatter will have its own display and use of channels; - access rights have been updated accordingly, using members instead of followers
2015-08-21[REF] mail: mail_thread: followers updateThibault Delavallée
Followers can now be partners or channels. Partners following a document will receive needaction, as previously. However people can follow documents through channels. Members of a channel are able to listen to a stream of messages using the channel. Those messages do not create needaction messages. It is therefore possible to follow documents without receiving too much notifications. For interesting documents subscribing with its partner will create notification. message_follower_ids fields is udpated. It is now a many2many to mail.followers, not to res.partner anymore. A subscription can be either a partner (partner_id) or a channel (channel_id). Some access rules have been updated accordingly.
2015-08-06[REM] mail, calendar: removed dead code (unused method and itsThibault Delavallée
override, unused variables; duplicated code; commented code)
2015-07-09[RENAME] mail, website_mail, website_mail_group, various: mail.groupThibault Delavallée
model has been renamed to mail.channel to prepare the slack modeling. In future commits the mail.group model will be merged with the channel model from im_chat. The first move is to rename mail.group into mail.channel to have a model that will unite both features.
2015-07-01[IMP] mail: new internal-only subtype feature.Thibault Delavallée
Starting from now, subtypes can be internal. This means that only employees (group_user members) can see the messages with this subtype. This feature replaces and enhances the 'log a note = no subtype = internal only' feature. Public and portal users cannot see internal messages. This allows to have subtypes and a follow mechanism that works for employees and is not visible for external people. Its first use will be for Crm Activities, allowing to have custom subtypes visible only for salesman and not send to the customer.
2013-06-06[IMP] Added description of record and name.Paramjit Singh Sahota
bzr revid: psa@tinyerp.com-20130606111206-01ykdwfohp73uhy2
2013-05-31[IMP] created a new record rule for the technical features group.Paramjit Singh Sahota
bzr revid: psa@tinyerp.com-20130531130912-ee0ptpjv27id4l32
2012-12-19[MERGE] Sync with trunk.Thibault Delavallée
bzr revid: tde@openerp.com-20121219093924-5rqmhb6ve7bv7qzl
2012-12-19[MERGE] Harmonization of noupdate flag on security XML data, courtesy of ↵Olivier Dony
Alexis de Lattre (Akretion) ir.rule records are in noupdate data blocks to let the admin alter them without fear of them being reset at next update. Other records such as groups are in normal mode, so they can be updated whenever necessary bzr revid: odo@openerp.com-20121218232001-t425t4hi7qbmsip2
2012-12-18[FIX] mail: users can now create private mail_group.Thibault Delavallée
bzr revid: tde@openerp.com-20121218121215-akxidhdegs4wjoeg
2012-11-07[FIX] mail: notifications: fixed access rights issues when setting as ↵Thibault Delavallée
read/unread for lambda users. bzr revid: tde@openerp.com-20121107153822-j7f1a63a2ix66e5n
2012-10-19[REVIEW] mail: some code cleanup before merging.Thibault Delavallée
mail.message: fixed to_read condition mail.message: cleaned message_read code mail.thread: fixed mega security hole, giving superuser rights when creating objects in mail.thread bzr revid: tde@openerp.com-20121019095919-xa95j10f22va6djm
2012-10-18[REVIEW] Cleaning before merging.Thibault Delavallée
bzr revid: tde@openerp.com-20121018093453-trijh79z0j7oha6f
2012-10-15[IMP] mail.followers: users can now read their own subscriptions.Thibault Delavallée
bzr revid: tde@openerp.com-20121015151127-5abtwg8uraj0du0u
2012-10-08[FIX] mail: in record rule, use partner id in mail_follower_ids instead of ↵Raphael Collet
user id bzr revid: rco@openerp.com-20121008151131-wi86wmjqxo44c7sq
2012-09-28[MERGE] trunkAntonin Bourguignon
bzr revid: abo@openerp.com-20120928152152-p6s1dzq96g0sy2sf
2012-09-19[IMP]User : Access rights in changed menu nameHardik
bzr revid: hsa@tinyerp.com-20120919085103-mmen7f0vzqvmp9bx
2012-09-14[FIX] mail: security: added read access on notifications.Thibault Delavallée
bzr revid: tde@openerp.com-20120914161657-bst7gz4d3er1i2rl
2012-09-14[REM] mail: removed unnecessary group and category for mail_manager.Thibault Delavallée
bzr revid: tde@openerp.com-20120914141849-i10vo6zjhclvgpu9
2012-08-16[FIX] mail.group security: member_ids -> message_follower_ids.Thibault Delavallée
bzr revid: tde@openerp.com-20120816000833-ld4cjhyvs8lc1ta4
2012-08-14[IMP] mail groups improvements: securityFabien Pinckaers
bzr revid: fp@openerp.com-20120814112204-hwamufqqz4qj9ptb
2012-08-14[ADD] mail: mail groupsFabien Pinckaers
extract groups and add new features to them? bzr revid: fp@tinyerp.com-20120814065136-nlwh14rwbgj57tqx
2012-07-13Harmonize the noupdate flag on security XML files :Alexis de Lattre
- ir.rule objects are noupdate="1" - all other objects are noupdate="0" bzr revid: alexis@via.ecp.fr-20120713170838-pjsysliyt6twazrc
2012-04-05[IMP] mail.thread: modified access rights. Users should now be able to ↵Thibault Delavallée
delete their messages. bzr revid: tde@openerp.com-20120405164719-6tlw4gav88ibb74r
2012-03-29[IMP] mail.thread: updated security rulesThibault Delavallée
bzr revid: tde@openerp.com-20120329163454-pbk5ivhgzyamd3jw
2012-03-29[IMP] First security check.Thibault Delavallée
bzr revid: tde@openerp.com-20120329161049-9a7nqm3ij2zsjy3f