From 4400da6ca4cbd2e95996543b730315e153b4075d Mon Sep 17 00:00:00 2001
From: Nicolas Mac Rouillon <nmr@ingadhoc.com>
Date: Thu, 3 Sep 2015 08:54:31 -0300
Subject: [PATCH] [FIX] project_issue_sheet: restrict inherited view access

The field timesheet_ids (hr.analytic.timesheet) and analytic_account_id
(account.analytic.account) should not be accessible by the portal user.

Fixes #8338
Closes #8354
---
 addons/project_issue_sheet/project_issue_sheet_view.xml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/addons/project_issue_sheet/project_issue_sheet_view.xml b/addons/project_issue_sheet/project_issue_sheet_view.xml
index 39ff9ca0010..23d4b5ae362 100644
--- a/addons/project_issue_sheet/project_issue_sheet_view.xml
+++ b/addons/project_issue_sheet/project_issue_sheet_view.xml
@@ -4,6 +4,7 @@
         <record model="ir.ui.view" id="project_issue_form_view">
             <field name="name">Project Issue Tracker Form</field>
             <field name="model">project.issue</field>
+            <field name="groups_id" eval="[(4, ref('base.group_user'))]"/>
             <field name="inherit_id" ref="project_issue.project_issue_form_view" />
             <field name="arch" type="xml">
                 <field name="project_id" position="attributes">