audrius/stock-rma
1
0
Fork 0
mirror of https://github.com/ForgeFlow/stock-rma.git synced 2025-01-21 12:57:49 +02:00
Code Issues Packages Projects Releases Wiki Activity

[FIX] multicompany security

Browse Source 
the rma module had company_id fields on rma.order and rma.order.line but not on rma.operation,
and no global multicompany record rules.

-> we fix this and avoid a mess with people allowed to see an operation in the drop down list
but unable to use it because if points to a warehouse of another company
This commit is contained in:
Alexandre Fayolle
2019-06-19 00:10:34 +02:00
committed by AaronHForgeFlow
parent a7d5841022
commit 747bcdcbc8
5 changed files with 26 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
rma/security/rma.xml
View File

@@ -49,6 +49,25 @@
eval="[(4, ref('group_rma_customer_user')),
(4, ref('group_rma_supplier_user'))]"/>
</record>
<record model="ir.rule" id="rma_order_rule">
<field name="name">rma order multi-company</field>
<field name="model_id" search="[('model','=','rma.order')]" model="ir.model"/>
<field name="global" eval="True"/>
<field name="domain_force">['|',('company_id','=',False),('company_id','child_of',[user.company_id.id])]</field>
</record>
<record model="ir.rule" id="rma_order_line_rule">
<field name="name">rma order line multi-company</field>
<field name="model_id" search="[('model','=','rma.order.line')]" model="ir.model"/>
<field name="global" eval="True"/>
<field name="domain_force">['|',('company_id','=',False),('company_id','child_of',[user.company_id.id])]</field>
</record>
<record model="ir.rule" id="rma_operation_rule">
<field name="name">rma operation multi-company</field>
<field name="model_id" search="[('model','=','rma.operation')]" model="ir.model"/>
<field name="global" eval="True"/>
<field name="domain_force">['|',('company_id','=',False),('company_id','child_of',[user.company_id.id])]</field>
</record>
</data>
</odoo>