From 0b2ee16885bfa03b1df577a0d9533ffe4c7b5bad Mon Sep 17 00:00:00 2001
From: Martin Trigaux <mat@odoo.com>
Date: Tue, 18 Nov 2014 15:09:13 +0100
Subject: [FIX] project: access rights and followers

For privacy_visibility 'followers' or 'portal', the user should be follower of the project (not the task).
Remove public access to portal task
Fixes #2372

If no project on the task (or other rule), an employee (not a portal) can access if is follower of the task.
Follower rule is not enough as a user creating a rule will subscribe to the rule but to subscribe to record, the user should have access to it in the first place.
To make sure the snake does not bit its tail, fallback to give access on task where the user is reponsible (user_id = user.id).
Fixes #139

Adapted the tests to the new behaviour (removed not relevant and added some on creation)
---
 addons/project/security/project_security.xml | 20 ++++++++++++--------
 1 file changed, 12 insertions(+), 8 deletions(-)

(limited to 'addons/project/security/project_security.xml')

diff --git a/addons/project/security/project_security.xml b/addons/project/security/project_security.xml
index 444a9d03b40..e1c2a8f997a 100644
--- a/addons/project/security/project_security.xml
+++ b/addons/project/security/project_security.xml
@@ -79,14 +79,18 @@
     <record model="ir.rule" id="task_visibility_rule">
         <field name="name">Project/Task: employees: public or employee or (followers and following)</field>
         <field name="model_id" ref="model_project_task"/>
-        <field name="domain_force">['|',
-                                        ('project_id.privacy_visibility', 'in', ['public', 'employees']),
-                                        '&amp;',
-                                            '|',
-                                                ('project_id', '=', False),
-                                                ('project_id.privacy_visibility', '=', 'followers'),
-                                            ('message_follower_ids', 'in', [user.partner_id.id]),
-                                    ]</field>
+        <field name="domain_force">[
+        '|',
+            ('project_id.privacy_visibility', 'in', ['public', 'employees']),
+            '|',
+                '&amp;',
+                    ('project_id.privacy_visibility', '=', 'followers'),
+                    ('project_id.message_follower_ids', 'in', [user.partner_id.id]),
+                '|',
+                    ('message_follower_ids', 'in', [user.partner_id.id]),
+                    # to subscribe check access to the record, follower is not enough at creation
+                    ('user_id', '=', user.id)
+        ]</field>
         <field name="groups" eval="[(4,ref('base.group_user'))]"/>
     </record>
 
-- 
cgit v1.2.3