| Age | Commit message (Collapse) | Author |
|---|
|
|
|
The ERP managers (users with 'Access Rights' rights) cannot even click on
the Settings app menuitem. Because of 2 things:
- The Dashboard settings is accessing the model ir_module_module. So
we set a groups 'group_settings' on it.
- The Users view is accessing the model ir_module_category to groups
the aggregate and display the settings. So we change the security rules
by giving the access to the group_erp_manager instead of group_settings
- The global rules opn companies was applied to the erp managers. We
splitted this ir.rules into three new ones on portal,public and employee
users to allow the erp managers to access the companies
- Writing on the res_groups was calling the method _update_user_groups_view
in all the cases. This method should be called only when the view was
needed to be modified, i.e. when the category_id is modified for this
group.
|
|
A translation of a field value for a given record can only be created/updated/
deleted if the current user has access rights for updating the record.
Access rights on translations are restricted to the group "Employee". Those
still need create/write/delete access, in order to be able to edit records in
the user interface. Other users (portal, etc.) simply have no explicit access
rights at all on translations.
|
|
Writing frequently to master data, and particularly to res.users
records is dangerous because it can temporarily delay/abort
concurrent transactions due to FK locking/serializability
heuristics. (Even with PostgreSQL 9.3+)
The `login_date` field updated when a user is authentiocated
is still useful but better handled in a separate table that
exclusively receives independent INSERTs (no UPDATE/DELETE).
This minimizes the chances of transactional conflicts.
This commit moves the login_date info into a separate
`res.users.log` table for this purpose, replacing it
with a related field. The user and login date info are
automatically handled by the magical fields (create_uid,
create_date) in `res.users.log`.
The related field must not be stored because that would
create the same problems as the original field.
In order to cleanup redundant entries in res.users.log
the 'auto-vacuum' cron job used for TransientModels was
extended to be a generic "internal data vacuum cleaner",
and now takes care of this as well.
The code for updating last login and vacuuming was split
up into smaller methods to make extensions easier.
Fixes #8585
Fixes #8590
|
|
* listing of modules in website already bypassed session user
* altered authenticated endpoint so it does the same
* sudoed a few read accesses & name_get in groups
* other accesses are list/form views, menu only accessible to
system_user
* new-API-ified some calls & unified listing of installed modules
|
|
Should not be necessary for the correct working of odoo (normal cron
lookup & processing is performed using raw SQL anyway).
* fixed a few ref calls just in case
* also cleaned up a few unused imports
|
|
This is only a model in case third parties need to override stuff, it
has no field and no reason to be a "concrete" model.
Also
* remove corresponding access rule giving CRUD to every user
* remove unnecessary import
* replace set() call by set literal
* replace dict(generator_expr) by dict comprehensions
|
|
Legacy model, doesn't seem to be used anywhere or have any point at all
yet was accessible CRUD to all...
|
|
usability + [IMP] account: bank journals are now the bank accounts of a company
|
|
Multi_company.default was used to set the default company on newly created
records in a multi-company environment. We remove it because it is redundant
with User-Defined Default.
The function _company_default_get is left for backward compatibility and to
allow the creation of modules that implement more complex policies.
|
|
ir.sequence.date_range, refactored ir.sequence and ir.sequence.date_range implementation
|
|
allows to have several sequences running for the same one depending on date ranges (similar to what was existing previously on accounting with FY, which is now deprecated) + port to new API
|
|
record rules.
Partial revert of commit 80017b04c2fefe895659f56e5e8d34bd59093e13.
Conflicts:
addons/web/static/src/js/chrome.js
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Add group of countries res.country.group
Add get_fiscal_position method a method to compute a fiscal position based on company_id, partner_id, delivery_id
The meaning of res.partner.fiscal_position is now a forced a fiscal position.
The default implementation should handle simple cases, like VAT in UE and sales
tax in the US, but the method can be overriden to handle more complex ficals
rules.
|
|
|
|
|
|
|
|
|
|
bzr revid: al@openerp.com-20140318002954-3vc2wj6llc2017bu
|
|
as those are abstract models. They should not have any access rules.
bzr revid: tde@openerp.com-20140116140621-6mjkp82oy0iyahi7
|
|
access_base_language_install_group_user
bzr revid: chm@openerp.com-20140113173509-4syed8md6drifv2q
|
|
bzr revid: chm@openerp.com-20140113082826-glv3v4pum6k4l1hh
|
|
group_user
bzr revid: chm@openerp.com-20140113082004-x494blqy2xjfc4wl
|
|
bzr revid: xmo@openerp.com-20131021152639-2o2j2knhuppdlbzm
|
|
bzr revid: xmo@openerp.com-20131014085215-qoqytud1mkpdqbz0
|
|
bzr revid: xmo@openerp.com-20131008122006-k7xjv2lkd0t7lza7
|
|
towards including portal stuff directly into server.
bzr revid: tde@openerp.com-20131008113338-mrkae8rwv4jif1x6
|
|
bzr revid: xmo@openerp.com-20131008082543-pzpknr48xfdbxxna
|
|
bzr revid: xmo@openerp.com-20131007113133-y0xcj0tgp8ionrzo
|
|
ir.fields architecture turns out not to be a very good or simple fit,
especially as different widgets/fields need different granularity of
customizations. Having objects dedicated to each field type/widget
makes things simpler as it allows a conversion pipeline which can be
plugged into at any point.
bzr revid: xmo@openerp.com-20131007091556-03azc2mdhcb7kmwo
|
|
bzr revid: tde@openerp.com-20131007081039-adyay7oy1tpx4g2k
|
|
bzr revid: al@openerp.com-20131006132424-bpd8w0zzuf42s55l
|
|
Moved low levels object to database structure.
Removed res.request models bu keep res.request.link, res.request.link is used
to flag models worth to be linked by references fields.
Moved currency and state to the approriate directory.
bzr revid: al@openerp.com-20131006112608-3qucrevmkf43kq20
|
|
Remove deprecated old style wizards.
Remove unsed get_model() function.
Move crons into Actions menuitem.
Move todos into Actions menuitem.
bzr revid: al@openerp.com-20131006102404-s46md70ahydihiih
|
|
bzr revid: tde@openerp.com-20131002133820-8xomdumexexqp3pk
|
|
add create to group_user
bzr revid: mat@openerp.com-20130912075353-s1hjsz3b0lvzhzj3
|
|
bzr revid: mat@openerp.com-20130911094257-yu17yffdawc45v2a
|
|
By default everybody should be able to read and modify
filters, and this is coupled with a global ir.rule that
only permits viewing and touching global filters and
owned filters.
bzr revid: odo@openerp.com-20130903172606-7vn0z2gz71urfdtz
|
