summaryrefslogtreecommitdiff
path: root/addons/purchase_requisition/security
AgeCommit message (Collapse)Author
2020-03-20[IMP] *: declare ir.rule in noupdateVictor Feyens
ir.rule are default values but can be customized based on the company's policy and needs. This is typically a record that is in noupdate as should be customization-friendly.
2020-03-20[IMP] *: remove global field definition in ir rules xmlVictor Feyens
It is a computed field, there is no need to manually set its value.
2019-05-13[IMP] base: Contextualize the multi companyYannick Tivisse
Purpose ======= Allow the user to select the allowed companies for which he wants to see records on top of selecting his current company. It is confusing for users to see the records from the company he is connected to and the records of the children companies. Instead of using the hierarchy of companies to access records across companies, the user can now select (from his set of allowed companies) the companies for which he wants to access records. /!\ This means that the user will interact with records from company A when in company B. Example: a SO has been created and confirmed in A. When in B, I create the invoice from it. Specifications ============== 1/ Deprecate the parent/children hierarchy on the res.company model. The fields are kept on the res.company model to ensure the retro-compatibility, but won't be used accross the standard code anymore. The only functional usage for this mechanism was to allow to see records from several companies by creating a virtual parent company, which will be possible with the new mechanism. 2/ By default, a user will only see the records of the company he is connected to (or records without a company). (It is still editable by the user if needed). For that, put this information in the user context, to allow having different configurations on different browser tabs. Instead of having domains like ['|', ('company_id', '=', False), ('company_id', 'child_of', user.company_id.id)] you'll have something like ['|', ('company_id', '=', False), ('company_id', 'in', company_ids)] Note that the 'company_ids' is a value that is passed in the evaluation context on the record rule, as we already have user, or time. company_ids is a list of the ids of all the enabled companies in the user's context. 3/ Out of the generic improvements brought by this task, this will illustrate issues that could exist since several versions. For example, it should not be possible to create a scrap order for the company A with a package of the company B, or it should not be possible to create an invoice on the company A with payment terms from the company B. Before the version 12.0, it was easy to encounter this kind of issues as the admin was the SUPERUSER_ID. A positive side effect of the fact that the SUPERUSER_ID has become an inactive user was to make it more difficult to introduce mismatch on the records, but haven't solved the issue, as it was still possible to do it with parent companies configuration. Some of these issues have been fixed in this commit, but all the business flows should be re-tested to check if an ir.rule should be introduced (eg: a multi company rule for stock.quand.package), if the company of a record is correctly transfered to another record created from the first record (eg: From a SO, create an invoice and a payment, the company of the sales order should be transfered on the invoice and the payment, even if the company of the sales order is A and I'm logged into the company B with the company A enabled. 4/ Currently, if I click on a button on a notification email (example 'View Task'), I face a traceback if I'm not logged into the company of the record. Now, if you click on a button and if you have access to the record, the correct company will be automatically set. 5/ If I display a kanban view with several records from several companies (and an image), all the images should be displayed. 6/ Currently if you copy paste an url, this will crash if you're not in the correct company. This won't be fixed because it's quite impossible to do it in a clean way. This task brings a workaround. Copy/Paste -> Traceback -> Log into the correct company, re-copy/paste -> Ok. 7/ 2 property methods have been added on the environment to retrieve the company on which the user is logged in and the companies the user enabled, on a specific tab. That way, when creating a record, instead of doing default=lambda self: self.env.user.company_id do default=lambda self: self.env.company_id On the other hand, to retrieve the enabled companies, do companies = self.env.company_ids 8/ Modify the Company Switcher widget to allow to log into another company WITHOUT writing on the res.users (and thus bringing cache invalidation issues and so on). Also allow to enable several companies and see records from several companies, and independantly of the other browser's tabs. 9/ When focusing on a tab, save the current company configuration on the local storage. That way, when doing 'CTRL+T' or a middle click, the context is propagated to the new tab. 10/ Improve the error message in case of multi company access errors. Now, when the user is in debug mode, display the related names of the records and the name of the user who brings the issue. 11/ Remove the context erasing when writing on a res.users This is probably coming from the migration to new API of the base module. The context was not propagated at this moment, which was a common mistake at that time. When migrating the module, probably by using the 'black box' method, as the context was not propagated, it was erased on the new version. This is now an issue because the context (i.e. the enabled companies) was erased when writing on a res.users, leading to tracebacks. See: https://github.com/odoo/odoo/commit/7eab8e26d3d46c53f4be924d6a34e80a66e74960#diff-4c2e738ee8f64f11806c889ea097b5e7R624 12/ Fix the crash manager on redirect warnings. The issue is the following - Create an invoice on a company without a configured CoA. - Set a partner - On the onchange_partner_id, a redirect warning is raised to propose you to configure a CoA - Click on 'Go to the configuration panel' - A generic warning says something like 'Do you want to discard your changes?' - Click on yes, the page refreshes, but not on the redirect action. Now, set correctly the action on the hash, and reload instead. The breadcrumb is lost for example, but you reach the correct action at least. 13/ Introduce a res.group to enable/disable the multi company per tab feature. 14/ To help the users to know which tab is in which company, add the possibility to have a favicon per company. When creating a company, the classical 'O' icon is colored by default in a random color. 15/ Remove the company switcher on the frontend. This was mainly there to allow a user to swicth to the company linked to the website. This behavior is now transparent to the user. If the website A is activated, then the company set on the context is the company of the website. 16/ Deprecated the _company_default_get method on the res.company model. Remove the method _get_company on the res.users model. 17/ Add 'allowed_company_ids' and 'current_company_id' on the pyeval context. You can now use those variables on domains in the views to access directly to the activated company.ies on the current tab. TaskID: 1960971 closes odoo/odoo#32341 Signed-off-by: Yannick Tivisse (yti) <yti@odoo.com>
2019-01-17[MOV] purchase_requisition: make requisition services friendlyHaresh Shyara
The purpose of this commit is to make requisition usable with only services. Stock part is extracted in a new module `purchase_requisition_stock` which allows to create requisition based on product availbility or demand, also we have moved all security access related stock in this bridge module. Task ID : 1851286
2018-11-19[MOV] purchase_requisition: split models and views filesjem-odoo
This commit simply move code into the right file. The goal is here to fit the guidelines and prepare the module for some changes. This will ease the reading of module code. Task-1851286 closes odoo/odoo#28795
2016-08-10[REF] various: rename openerp node to odoo in xml filesThibault Delavallée
2016-04-29[IMP] purchase_requisition: blanket orders and usability cleaningFabien Pinckaers
Improved usability & code cleaning: - Support for blanket orders, in addition of purchase tenders ("Purchase Agreements") - Create a RfQ in one click, no wizard anymore - Control of quantities really purchased - Better control of side-effects thanks to purchase requisition types - JS code removed (not necessary) - Workflow removed Closes #11666
2015-08-12[IMP] purchase_requisition: groups and config updateGaurav Panchal
Remove custom Purchase Requisition category, as well as purchase_requisition user and manager groups. Those groups are not used except in one view as purchase groups are already used for access rights. We now use purchase user and manager groups instead of the purchase requisition groups.
2013-02-21[IMP] improve codeForam Katharotiya (OpenERP)
bzr revid: fka@tinyerp.com-20130221061737-d7vyr9lpwnas1qay
2012-07-13Harmonize the noupdate flag on security XML files :Alexis de Lattre
- ir.rule objects are noupdate="1" - all other objects are noupdate="0" bzr revid: alexis@via.ecp.fr-20120713170838-pjsysliyt6twazrc
2012-04-04[IMP] groups: remove auto-inclusion of admin in groups, and make the ↵Raphael Collet
inclusion explicit in groups bzr revid: rco@openerp.com-20120404090830-nteimn2kvz8nkk7h
2011-12-13[MERGE] trunk-user-groups-rco: add category_id to groupsRaphael Collet
bzr revid: rco@openerp.com-20111213141949-ohvn0c9iq6tcl7jj
2011-12-12[IMP] Security Rule: removed duplicates due to inheritancies of groupsFabien Pinckaers
bzr revid: fp@tinyerp.com-20111212181113-mhnnbps3ip8ls6pp
2011-12-12[IMP] product, project, purchase, purchase_requisition: add group categoriesRaphael Collet
bzr revid: rco@openerp.com-20111212140528-g8oxverkipswionf
2011-08-02add group implicationsRaphael Collet
bzr revid: rco@openerp.com-20110802130811-pkdmw43ufifz0tpj
2011-02-28[REVERT] all: revert incorrect change of default ir.rules for multi-companyOlivier Dony
By default only records belonging to the user's company or descendant companies should be visible. The original patch introduced visibility of records from ancestor companies, which should be suited only for a few cases, such as res.patner. Original revision: 3164.24.175 sbh@tinyerp.com-20101223095216-n6psmzicdcs8is8x lp bug: https://launchpad.net/bugs/720175 fixed bzr revid: odo@openerp.com-20110228135754-6skiy4fb9dg54xb6
2011-01-13[FIX] STOCK:Create invoice button is visible in picking (ALL 3) is set to ↵aag (OpenERP)
be invoiced lp bug: https://launchpad.net/bugs/701389 fixed bzr revid: aag@tinyerp.co.in-20110113092551-ds3n0gne3xouq7lq
2011-01-11[FIX] purchase_requisition:Permissions on procurementaag (OpenERP)
lp bug: https://launchpad.net/bugs/699784 fixed bzr revid: aag@tinyerp.co.in-20110111110729-m0h3yqcvalxkbxwt
2010-12-23[Fix] : correct security rule of company_idSbh (OpenERP)
bzr revid: sbh@tinyerp.com-20101223095216-n6psmzicdcs8is8x
2010-11-19[IMP]: Moved reference of demo user from *_security.xml to demo filerpa (Open ERP)
bzr revid: rpa@tinyerp.com-20101119102525-8gyj1gmm1w29rwxu
2010-11-19[MERGE]: Merge with lp:~openerp-commiter/openobject-addons/trunk-addons-aagrpa (Open ERP)
bzr revid: rpa@tinyerp.com-20101119072430-0rgszlgidvyezsvd
2010-11-11[IMP] IN ALL: the demo user should be in all applications name user groups, ↵aag (OpenERP)
Task id: 1771 bzr revid: aag@tinyerp.co.in-20101111131855-v07piwfyp33wlmng
2010-11-01[IMP]: Add rights for purchase user and related with other userksa (Open ERP)
bzr revid: ksa@tinyerp.co.in-20101101124537-7h3acibsx82thvej
2010-10-18[IMP] ir.rule reviewedFabien Pinckaers
bzr revid: fp@tinyerp.com-20101018092840-7a6wv2vw2s6a1a2s
2010-08-10[FIX] purchase_requisition: Add an opening tagStephane Wirtel
bzr revid: stephane@openerp.com-20100810112951-wno54zwr75oowsk3
2010-08-07[MOD] purchase_* : Modification in access rightsVir (Open ERP)
bzr revid: vir@tinyerp.com-20100807063414-u5uhbdfwuijgxcv7
2010-04-28[IMP]:changes in ir.rule demo to support the new functionaliy of ir.ruleRvo (Open ERP)
bzr revid: rvo@tinyerp.co.in-20100428125109-wq33afl8104gx6rf
2010-04-16[IMP] purchase_requisition: rename the object and improve the viewsbh (Open ERP)
bzr revid: sbh@tinyerp.com-20100416061750-2wortgmkaeogbh0t
2010-04-16[Merge]: lp:openobject-addonssbh (Open ERP)
bzr revid: sbh@tinyerp.com-20100416044236-ztzke56zfdp8iyra
2010-04-09purchase tender -> purchase requisitionFabien Pinckaers
bzr revid: fp@tinyerp.com-20100409071817-2m17aqeittryko8k