summaryrefslogtreecommitdiff
path: root/odoo/addons/base/security/base_security.xml
AgeCommit message (Collapse)Author
2019-02-14[IMP] hr_*: introduce the employee profileLucas Lefèvre
General Purpose =============== We want an 'Employee profile' gathering every data about an employee. The main form view is modified to become this employee profile. A user can also see his own profile through the Preferences menu. The new profile replaces the current Preferences view if the hr module is installed and the current user is linked to an employee. A user should be able to see and edit his own profile. *Problem*: Many fields on hr.employee are protected by groups="hr.group_hr_user". Therefore, a regular user cannot see or edit those fields. This protection must be bypassed to allow read/write access to the regular user's own data. A similar mechanism already exists for res.users (for Preferences) The better (least worst) solution found is to reuse this mechanism by adding related fields on res.users. Pros: - Don't change security access on hr.employee - Don't implement yet another custom security layer, risking to add new security breaches - A lot of fields are added by other modules on hr.employee. It would have required to integrate them with the custom security layer. - Fields added by other modules on the user's preferences view (normal view, not the profile) are automatically included in the employee's profile view. - Allow the hr.employee form view to be different than the user profile accessible through the Preferences menu. E.g. add custom buttons only relevant to the logged in user such as "Request a leave". Cons: - Each field from hr.employee that you want to appear on its profile must be added as a related field on res.users - Those related fields must be added to user's preferences view (duplicate views) - They also must be added to SELF_[READABLE | WRITABLE]_FIELDS Note: When the front-end loads the views it gets the list of available fields for the user (according to its access rights). Later, when the front-end wants to populate the view with data, it only asks to read those available fields. However, in this case, we want the user to be able to read/write its own data, even if they are protected by groups (groups are kept on the related fields on res.users). The front-end need to be made aware of those fields by sending all field definitions. hr_attendance ============= This commit integrate attendance in the new employee profile. It also adds a stat button to this employee profile showing the number of hours worked last month. Remove the boolean computed field 'manual_attendance'. This field is just a shortcut to add/remove the employee's user in the "Manual Attendance" group. The checkbox is confusing on the employee's form and this should be done through the normal group management screens. hr_presence =========== Display the presence status on the employee kanban template. The status is a colored chip which can be green (present), orange (to define) or red (absent). Currently, the presence status is only computed when accessing the report view. As this commits displays it on the employee kanban, it should be updated more frequently. The state should not be updated every time the kanban view is loaded since the computation is a bit heavy. Instead: add a cron to update status every 15 minutes. -> The status is accurate on the report view (status is still updated when loading the view) -> The status in accurate at 15 minutes on the kanban view [ADD] hr_attendance_presence ============================ Bridge module between hr_attendance and hr_presence. This commit integrates hr_presence module in the employee profile and adds the presence status on the employee kanban view. But hr_attendance adds at the same place a similar status icon for checkin/checkout. This bridge module makes the status from hr_presence invisible as hr_attendance should be the main presence control mechanism. Also, this commit adds the ability (through a new setting option) for hr_presence to take into account checkin/checkout to determine the presence status. l10n_be_hr_payroll ================== integration with employee profile
2018-06-15[MERGE] forward port branch saas-11.3 up to 50860317ccdChristophe Simonis
Note: 1aacc962620982528a3dfc90d2c1dd0027359375 has been ignored and will be forward-ported later
2018-06-12[MERGE] forward port branch 11.0 up to e3658d6f568Christophe Simonis
2018-06-12[MERGE] forward port branch saas-15 up to d44cd778844Christophe Simonis
2018-06-11[MERGE] forward port branch 10.0 up to 90326171201Christophe Simonis
2018-06-11[MERGE] forward port branch 9.0 up to 06a085b25faChristophe Simonis
2018-05-29[MERGE] forward port branch saas-11.3 up to 37eed7c509fChristophe Simonis
2018-05-25[MERGE] forward port branch 11.0 up to 2ca72960001Christophe Simonis
2018-05-25[MERGE] forward port branch saas-15 up to dbb2b9bf73dChristophe Simonis
2018-05-24[MERGE] forward port branch 10.0 up to 3051d1dd2feChristophe Simonis
2018-05-24[MERGE] forward port branch 9.0 up to 919a1af9360Christophe Simonis
2018-05-04[IMP] base: Add support for private addressesYannick Tivisse
Purpose ======= Add the possibility to create private addresses, only accessible for a subset of users. Specification ============= - Add a new 'Private' partner type - Add a res.groups in base 'Access to Private Addresses' - Add ir.rules for the following behavior: - Every employees/internal users can read non-private addresses - Only users in group_private_addresses can access private addresses - Add in base a simplified form view for private addresses - A HR Officer is automatically granted in group_private_addresses - Use the simplified form view to open the address_home_id form on employees
2017-11-27[SPLIT] base: split base_security to separate groups from rulesThibault Delavallée
2017-11-27[MOV] base: regroup all security rules in the same file in security/Thibault Delavallée
* get some ir_rules from view files * move all rules into same file
2017-09-15[IMP] mass_mailing: choose model among all chatter modelsYannick Tivisse
This commit removes the strange selection box based on a magic flag and some strange methods returning a string. Instead just allow to send mass mailing on all models inheriting from mail.thread using the is mail thread flag. Various addons are updated to remove the _mail_mass_mailing class attribute used to determine mass mailing capability. We consider people could send a mass mailing on every model inheriting from mail.thread. It makes no sense to limit it to a given set of addons.
2017-08-28[REM] base: remove model `ir.values`Raphael Collet
2017-08-28[ADD] base: model `ir.default` to store user-defined defaultsRaphael Collet
2017-03-23[MOV] base,portal: make portal module emptyJérome Maes
The goal is to prepare the removal of 'portal' module. - demo portal user is moved into base - 'is_portal' field on res.group too - remaining security rule are moved to base too - mail template is moved to website_portal
2017-01-03[REF] ir_config_parameter: remove `group_ids` and simplifyRaphael Collet
Add `sudo()` to call `get_param` where necessary, and make the web client use a controller instead of directly accessing parameters.
2017-01-03[IMP] base, *: tighten `ir.config_parameter` access rightsRaphael Collet
Add `base.group_system` on existing parameters: - `auth_signup.allow_uninvited`, - `auth_signup.reset_password`, - `auth_signup.template_user_id`, - `google_redirect_uri`, - `mail.bounce.alias`, - `mail.catchall.alias`, - `mail.catchall.domain`.
2016-09-02[REF] openerp: move `openerp` to `odoo`Raphael Collet