From 52da4b041c1e62cb2c76d0875d5ad317fae05563 Mon Sep 17 00:00:00 2001 From: Christophe Matthieu Date: Thu, 6 Dec 2012 13:14:09 +0100 Subject: [PATCH] [IMP] mail_group: remove inherits of ir.ui.menu form mail_group to improve managment of access rights. bzr revid: chm@openerp.com-20121206121409-z04iygrv34png4aj --- addons/mail/mail_group.py | 52 +++++++++++++++++++++++---------------- 1 file changed, 31 insertions(+), 21 deletions(-) diff --git a/addons/mail/mail_group.py b/addons/mail/mail_group.py index f69de54ddbf..b5911e513b8 100644 --- a/addons/mail/mail_group.py +++ b/addons/mail/mail_group.py @@ -33,7 +33,7 @@ class mail_group(osv.Model): _name = 'mail.group' _mail_flat_thread = False _inherit = ['mail.thread'] - _inherits = {'mail.alias': 'alias_id', 'ir.ui.menu': 'menu_id'} + _inherits = {'mail.alias': 'alias_id'} def _get_image(self, cr, uid, ids, name, args, context=None): result = dict.fromkeys(ids, False) @@ -44,7 +44,12 @@ class mail_group(osv.Model): def _set_image(self, cr, uid, id, name, value, args, context=None): return self.write(cr, uid, [id], {'image': tools.image_resize_image_big(value)}, context=context) + def _get_name(self, cr, uid, context=None): + ref = self.pool.get('ir.model.data').get_object_reference(cr, uid, 'base', 'group_user') + return ref and ref[1] or False + _columns = { + 'name': fields.char('Name', size=64, required=True, translate=True), 'description': fields.text('Description'), 'menu_id': fields.many2one('ir.ui.menu', string='Related Menu', required=True, ondelete="cascade"), 'public': fields.selection([('public', 'Public'), ('private', 'Private'), ('groups', 'Selected Group Only')], 'Privacy', required=True, @@ -88,15 +93,10 @@ class mail_group(osv.Model): image_path = openerp.modules.get_module_resource('mail', 'static/src/img', 'groupdefault.png') return tools.image_resize_image_big(open(image_path, 'rb').read().encode('base64')) - def _get_menu_parent(self, cr, uid, context=None): - ref = self.pool.get('ir.model.data').get_object_reference(cr, uid, 'mail', 'mail_group_root') - return ref and ref[1] or False - _defaults = { 'public': 'groups', 'group_public_id': _get_default_employee_group, 'image': _get_default_image, - 'parent_id': _get_menu_parent, 'alias_domain': False, # always hide alias during creation } @@ -118,14 +118,18 @@ class mail_group(osv.Model): model_name=self._name, context=context) vals['alias_id'] = alias_id - #check access rights for the current user, then create as SUPERUSER because the object inherits - #ir.ui.menu (for which normal users do not have creation rights) - self.check_access_rights(cr, uid, 'create') - mail_group_id = super(mail_group, self).create(cr, SUPERUSER_ID, vals, context=context) - if uid != SUPERUSER_ID: - # creator is the first follower - user_pid = self.pool.get('res.users').read(cr, uid, uid, ['partner_id'], context=context)['partner_id'][0] - self.write(cr, SUPERUSER_ID, [mail_group_id], {'message_follower_ids': [(6, 0, [user_pid])]}, context=context) + # get parent menu + menu_parent = self.pool.get('ir.model.data').get_object_reference(cr, uid, 'mail', 'mail_group_root') + menu_parent = menu_parent and menu_parent[1] or False + + # Create menu id + mobj = self.pool.get('ir.ui.menu') + menu_id = mobj.create(cr, SUPERUSER_ID, {'name': vals['name'], 'parent_id': menu_parent}, context=context) + vals['menu_id'] = menu_id + + # Create group and alias + mail_group_id = super(mail_group, self).create(cr, uid, vals, context=context) + mail_alias.write(cr, uid, [vals['alias_id']], {"alias_force_thread_id": mail_group_id}, context) # Create client action for this group and link the menu to it ref = self.pool.get('ir.model.data').get_object_reference(cr, uid, 'mail', 'action_mail_group_feeds') @@ -141,9 +145,7 @@ class mail_group(osv.Model): } cobj = self.pool.get('ir.actions.client') newref = cobj.copy(cr, SUPERUSER_ID, ref[1], default={'params': str(params), 'name': vals['name']}, context=context) - self.write(cr, SUPERUSER_ID, [mail_group_id], {'action': 'ir.actions.client,' + str(newref), 'mail_group_id': mail_group_id}, context=context) - - mail_alias.write(cr, uid, [vals['alias_id']], {"alias_force_thread_id": mail_group_id}, context) + mobj.write(cr, SUPERUSER_ID, menu_id, { 'action': 'ir.actions.client,' + str(newref), 'mail_group_id': mail_group_id}, context=context) if vals.get('group_ids'): self._subscribe_users(cr, uid, [mail_group_id], context=context) @@ -154,11 +156,12 @@ class mail_group(osv.Model): # Cascade-delete mail aliases as well, as they should not exist without the mail group. mail_alias = self.pool.get('mail.alias') alias_ids = [group.alias_id.id for group in groups if group.alias_id] - # Cascade-delete menu entries as well - self.pool.get('ir.ui.menu').unlink(cr, uid, [group.menu_id.id for group in groups if group.menu_id], context=context) # Delete mail_group res = super(mail_group, self).unlink(cr, uid, ids, context=context) - mail_alias.unlink(cr, uid, alias_ids, context=context) + # Delete alias + mail_alias.unlink(cr, SUPERUSER_ID, alias_ids, context=context) + # Cascade-delete menu entries as well + self.pool.get('ir.ui.menu').unlink(cr, SUPERUSER_ID, [group.menu_id.id for group in groups if group.menu_id], context=context) return res def write(self, cr, uid, ids, vals, context=None): @@ -168,10 +171,17 @@ class mail_group(osv.Model): # if description is changed: update client action if vals.get('description'): cobj = self.pool.get('ir.actions.client') - for action in [group.action for group in self.browse(cr, SUPERUSER_ID, ids, context=context) if group.action]: + for action in [group.menu_id.action for group in self.browse(cr, uid, ids, context=context)]: new_params = action.params new_params['header_description'] = vals.get('description') cobj.write(cr, SUPERUSER_ID, [action.id], {'params': str(new_params)}, context=context) + # if name is changed: update menu + if vals.get('name'): + mobj = self.pool.get('ir.ui.menu') + mobj.write(cr, SUPERUSER_ID, + [group.menu_id.id for group in self.browse(cr, uid, ids, context=context)], + {'name': vals.get('name')}, context=context) + return result def action_follow(self, cr, uid, ids, context=None):