Merge lp:~openerp-dev/openobject-server/trunk-bug-917524-mtr into lp:openobject-server

[Meera Trambadia (OpenERP)]

base/security: added and modify record rule for ir.values for configuration and employee groups --fixes=lp:917524

[Raphael Collet (OpenERP) (rco-openerp)]

Be careful, with this change all users have full access to ir.values!

Before you had a *global* ir.model.access (access_ir_values_group_all) with a *global* ir.rule (ir_values_default_rule) that restricts write, create and delete accesses with a domain. Now that the ir.rule becomes local, the global ir.model.access gives all users full access without a domain! In other words, the local ir.rule has no effect in this situation.

I suggest the following change:
 - make the ir.model.access 'access_ir_values_group_all' global, but with *read* permission only;
 - create an ir.model.access for group 'group_system' with all permissions;
 - create an ir.model.access for group 'group_user', with all permissions;
 - make the ir.rule 'ir_values_default_rule' local to 'group_user'.

With that change, we have the expected access rights:
 - all users have read access to ir.values;
 - users of 'group_user' have write, create, and delete access limited to "their" values;
 - users of 'group_system' have full access to all ir.values.

Thanks,
Raphael

review: Needs Fixing

[lp:~openerp-dev/openobject-server/trunk-bug-917524-mtr]

3985. By Meera Trambadia (OpenERP) on 2012-02-13

[MERGE] branch merged with lp:openobject-server

3986. By Meera Trambadia (OpenERP) on 2012-02-14

[MERGE] branch merged with lp:openobject-server

Unmerged revisions

3986. By Meera Trambadia (OpenERP) on 2012-02-14

[MERGE] branch merged with lp:openobject-server

3985. By Meera Trambadia (OpenERP) on 2012-02-13

[MERGE] branch merged with lp:openobject-server

3984. By Meera Trambadia (OpenERP) on 2012-01-27

[FIX] base: added and modify record rule for ir.values for configuration and employee groups

=== modified file 'openerp/addons/base/security/base_security.xml'
--- openerp/addons/base/security/base_security.xml	2011-12-02 16:14:56 +0000
+++ openerp/addons/base/security/base_security.xml	2012-02-14 05:14:18 +0000
@@ -72,6 +72,14 @@
             <field name="model_id" ref="model_ir_values"/>
             <field name="domain_force">[('key','=','default'),('user_id','=',user.id)]</field>
             <field name="perm_read" eval="False"/>
+            <field name="groups" eval="[(4,ref('group_user'))]"/>
+        </record>
+
+        <record model="ir.rule" id="ir_values_all_rule">
+            <field name="name">All: alter all values</field>
+            <field name="model_id" ref="model_ir_values"/>
+            <field name="domain_force">[(1,'=',1)]</field>
+            <field name="groups" eval="[(4,ref('group_system'))]"/>
         </record>
 
         <!-- Used for dashboard customizations, users should only be able to edit their own dashboards -->