2008-09-10 17:56:00 +00:00
|
|
|
<openerp>
|
2008-08-19 19:42:11 +00:00
|
|
|
<data>
|
|
|
|
|
|
|
|
<record id="view_partner_property_form" model="ir.ui.view">
|
|
|
|
<field name="name">res.partner.product.property.form.inherit</field>
|
|
|
|
<field name="model">res.partner</field>
|
|
|
|
<field name="inherit_id" ref="base.view_partner_form"/>
|
[FIX] *: accesses of views concernings specific groups
If the whole view relates to a specific group,
apply the group on the view itself instead of
each view part (each fields, each page, each div,...),
so the view is loaded / added to the base view
only if the user is in the right group.
So the view is not loaded uselessly
and the fields are not read for nothing
(performances & security).
Indeed, when a group is applied on a field itself, the field content
is read, but hidden, therefore reading the content of the field
uselessly, and potentially leading to accesses issues
if the user hasn't the rights to read the field.
(e.g. reading a property when not having access to the model
of the proprty, pricelists on partners for instance)
opw-634402
2015-05-12 09:20:14 +00:00
|
|
|
<field name="groups_id" eval="[(4, ref('product.group_sale_pricelist'))]"/>
|
2008-08-19 19:42:11 +00:00
|
|
|
<field name="arch" type="xml">
|
2008-08-25 22:20:48 +00:00
|
|
|
<page string="Sales & Purchases" position="inside">
|
2012-06-18 16:00:57 +00:00
|
|
|
<group>
|
2013-05-09 10:30:45 +00:00
|
|
|
<group name="pricelists" attrs="{'invisible': [('is_company','=',False),('parent_id','!=',False)]}">
|
[FIX] *: accesses of views concernings specific groups
If the whole view relates to a specific group,
apply the group on the view itself instead of
each view part (each fields, each page, each div,...),
so the view is loaded / added to the base view
only if the user is in the right group.
So the view is not loaded uselessly
and the fields are not read for nothing
(performances & security).
Indeed, when a group is applied on a field itself, the field content
is read, but hidden, therefore reading the content of the field
uselessly, and potentially leading to accesses issues
if the user hasn't the rights to read the field.
(e.g. reading a property when not having access to the model
of the proprty, pricelists on partners for instance)
opw-634402
2015-05-12 09:20:14 +00:00
|
|
|
<field name="property_product_pricelist"/>
|
2012-06-18 16:00:57 +00:00
|
|
|
</group>
|
[FIX] *: accesses of views concernings specific groups
If the whole view relates to a specific group,
apply the group on the view itself instead of
each view part (each fields, each page, each div,...),
so the view is loaded / added to the base view
only if the user is in the right group.
So the view is not loaded uselessly
and the fields are not read for nothing
(performances & security).
Indeed, when a group is applied on a field itself, the field content
is read, but hidden, therefore reading the content of the field
uselessly, and potentially leading to accesses issues
if the user hasn't the rights to read the field.
(e.g. reading a property when not having access to the model
of the proprty, pricelists on partners for instance)
opw-634402
2015-05-12 09:20:14 +00:00
|
|
|
<div name="parent_pricelists" attrs="{'invisible': ['|',('is_company','=',True),('parent_id','=',False)]}">
|
2013-04-07 23:50:13 +00:00
|
|
|
<p>Pricelists are managed on <button name="open_commercial_entity" type="object" string="the parent company" class="oe_link"/></p>
|
|
|
|
</div>
|
2008-08-25 22:20:48 +00:00
|
|
|
</group>
|
2008-08-19 19:42:11 +00:00
|
|
|
</page>
|
|
|
|
</field>
|
|
|
|
</record>
|
|
|
|
|
|
|
|
</data>
|
2008-09-10 17:56:00 +00:00
|
|
|
</openerp>
|