From ac92551406c333dc6829126e4c2fc6f0f1c613f9 Mon Sep 17 00:00:00 2001
From: Denis Ledoux <dle@odoo.com>
Date: Wed, 20 May 2015 11:05:11 +0200
Subject: [PATCH] [FIX] ir_attachment: hide Attachments > Add/Delete if not
 write access

To be able to see record attachments, you need to have
read access to the record.

To be able to add or delete attachment, you need to
have write access to the record.

The button add/delete were displayed as soon
as you had the read access, but if you had not the
write access, both buttons failed.

This revision do not display the add/delete
buttons of Attachment dropdown menu if you do not
have the right to add / delete attachments to the record
(you do not have write access to the record)

opw-640242
---
 addons/web/static/src/js/views.js  | 2 +-
 addons/web/static/src/xml/base.xml | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/addons/web/static/src/js/views.js b/addons/web/static/src/js/views.js
index 7f9e2f09420..5b08c317b2b 100644
--- a/addons/web/static/src/js/views.js
+++ b/addons/web/static/src/js/views.js
@@ -1164,7 +1164,7 @@ instance.web.Sidebar = instance.web.Widget.extend({
     init: function(parent) {
         var self = this;
         this._super(parent);
-        var view = this.getParent();
+        this.view = this.getParent();
         this.sections = [
             { 'name' : 'print', 'label' : _t('Print'), },
             { 'name' : 'other', 'label' : _t('More'), }
diff --git a/addons/web/static/src/xml/base.xml b/addons/web/static/src/xml/base.xml
index d28d021e298..1f22adace16 100644
--- a/addons/web/static/src/xml/base.xml
+++ b/addons/web/static/src/xml/base.xml
@@ -648,9 +648,9 @@
                         <a class="oe_sidebar_action_a" t-att-title="item.title or ''" t-att-data-section="section.name" t-att-data-index="item_index" t-att-href="item.url" target="_blank">
                             <t t-raw="item.label"/>
                         </a>
-                         <a t-if="section.name == 'files' and !item.callback" class="oe_sidebar_delete_item" t-att-data-id="item.id" title="Delete this attachment">x</a>
+                         <a t-if="widget.view.is_action_enabled('edit') &amp;&amp; section.name == 'files' and !item.callback" class="oe_sidebar_delete_item" t-att-data-id="item.id" title="Delete this attachment">x</a>
                     </li>
-                    <li t-if="section.name == 'files'" class="oe_sidebar_add_attachment">
+                    <li t-if="widget.view.is_action_enabled('edit') &amp;&amp; section.name == 'files'" class="oe_sidebar_add_attachment">
                         <t t-call="HiddenInputFile">
                             <t t-set="fileupload_id" t-value="widget.fileupload_id"/>
                             <t t-set="fileupload_action" t-translation="off">/web/binary/upload_attachment</t>