diff --git a/setup/web_access_rule_buttons/odoo/addons/web_access_rule_buttons b/setup/web_access_rule_buttons/odoo/addons/web_access_rule_buttons new file mode 120000 index 000000000..f8d994ad9 --- /dev/null +++ b/setup/web_access_rule_buttons/odoo/addons/web_access_rule_buttons @@ -0,0 +1 @@ +../../../../web_access_rule_buttons \ No newline at end of file diff --git a/setup/web_access_rule_buttons/setup.py b/setup/web_access_rule_buttons/setup.py new file mode 100644 index 000000000..28c57bb64 --- /dev/null +++ b/setup/web_access_rule_buttons/setup.py @@ -0,0 +1,6 @@ +import setuptools + +setuptools.setup( + setup_requires=['setuptools-odoo'], + odoo_addon=True, +) diff --git a/web_access_rule_buttons/README.rst b/web_access_rule_buttons/README.rst new file mode 100644 index 000000000..171ef5ed3 --- /dev/null +++ b/web_access_rule_buttons/README.rst @@ -0,0 +1,84 @@ +======================== +Web Access Rules Buttons +======================== + +.. !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! + !! This file is generated by oca-gen-addon-readme !! + !! changes will be overwritten. !! + !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! + +.. |badge1| image:: https://img.shields.io/badge/maturity-Beta-yellow.png + :target: https://odoo-community.org/page/development-status + :alt: Beta +.. |badge2| image:: https://img.shields.io/badge/licence-AGPL--3-blue.png + :target: http://www.gnu.org/licenses/agpl-3.0-standalone.html + :alt: License: AGPL-3 +.. |badge3| image:: https://img.shields.io/badge/github-OCA%2Fweb-lightgray.png?logo=github + :target: https://github.com/OCA/web/tree/11.0/web_access_rule_buttons + :alt: OCA/web +.. |badge4| image:: https://img.shields.io/badge/weblate-Translate%20me-F47D42.png + :target: https://translation.odoo-community.org/projects/web-11-0/web-11-0-web_access_rule_buttons + :alt: Translate me on Weblate +.. |badge5| image:: https://img.shields.io/badge/runbot-Try%20me-875A7B.png + :target: https://runbot.odoo-community.org/runbot/162/11.0 + :alt: Try me on Runbot + +|badge1| |badge2| |badge3| |badge4| |badge5| + +This addon disables the Edit button on the form views if the user +cannot edit the current record according to the record access rules. + +**Table of contents** + +.. contents:: + :local: + +Usage +===== + +When using Odoo, even if a user has no rights to edit a record, the Edit button +is shown. The user can edit the record but won't be able to save his changes. +Now, the user won't be able to click on the Edit button. + +Bug Tracker +=========== + +Bugs are tracked on `GitHub Issues `_. +In case of trouble, please check there if your issue has already been reported. +If you spotted it first, help us smashing it by providing a detailed and welcomed +`feedback `_. + +Do not contact contributors directly about support or help with technical issues. + +Credits +======= + +Authors +~~~~~~~ + +* Camptocamp +* Onestein + +Contributors +~~~~~~~~~~~~ + +* Guewen Baconnier +* Antonio Esposito +* Dhara Solanki + +Maintainers +~~~~~~~~~~~ + +This module is maintained by the OCA. + +.. image:: https://odoo-community.org/logo.png + :alt: Odoo Community Association + :target: https://odoo-community.org + +OCA, or the Odoo Community Association, is a nonprofit organization whose +mission is to support the collaborative development of Odoo features and +promote its widespread use. + +This module is part of the `OCA/web `_ project on GitHub. + +You are welcome to contribute. To learn how please visit https://odoo-community.org/page/Contribute. diff --git a/web_access_rule_buttons/__init__.py b/web_access_rule_buttons/__init__.py new file mode 100644 index 000000000..31660d6a9 --- /dev/null +++ b/web_access_rule_buttons/__init__.py @@ -0,0 +1,3 @@ +# License AGPL-3.0 or later (https://www.gnu.org/licenses/agpl). + +from . import models diff --git a/web_access_rule_buttons/__manifest__.py b/web_access_rule_buttons/__manifest__.py new file mode 100644 index 000000000..3b1ebf025 --- /dev/null +++ b/web_access_rule_buttons/__manifest__.py @@ -0,0 +1,19 @@ +# Copyright 2016 Camptocamp SA +# License AGPL-3.0 or later (https://www.gnu.org/licenses/agpl). + +{ + "name": "Web Access Rules Buttons", + "summary": "Disable Edit button if access rules prevent this action", + "version": "14.0.1.0.0", + "author": "Camptocamp, Onestein, Odoo Community Association (OCA)", + "license": "AGPL-3", + "category": "Web", + "depends": [ + "web", + ], + "website": "https://github.com/OCA/web", + "data": [ + "views/web_access_rule_buttons.xml", + ], + "installable": True, +} diff --git a/web_access_rule_buttons/i18n/web_access_rule_buttons.pot b/web_access_rule_buttons/i18n/web_access_rule_buttons.pot new file mode 100644 index 000000000..dc9d0b2aa --- /dev/null +++ b/web_access_rule_buttons/i18n/web_access_rule_buttons.pot @@ -0,0 +1,35 @@ +# Translation of Odoo Server. +# This file contains the translation of the following modules: +# * web_access_rule_buttons +# +msgid "" +msgstr "" +"Project-Id-Version: Odoo Server 11.0\n" +"Report-Msgid-Bugs-To: \n" +"Last-Translator: <>\n" +"Language-Team: \n" +"MIME-Version: 1.0\n" +"Content-Type: text/plain; charset=UTF-8\n" +"Content-Transfer-Encoding: \n" +"Plural-Forms: \n" + +#. module: web_access_rule_buttons +#: model:ir.model.fields,field_description:web_access_rule_buttons.field_ir_cron_channel_ids +msgid "Add Channels" +msgstr "" + +#. module: web_access_rule_buttons +#: model:ir.model.fields,field_description:web_access_rule_buttons.field_ir_cron_partner_ids +msgid "Add Followers" +msgstr "" + +#. module: web_access_rule_buttons +#: model:ir.model.fields,field_description:web_access_rule_buttons.field_ir_cron_template_id +msgid "Email Template" +msgstr "" + +#. module: web_access_rule_buttons +#: model:ir.model,name:web_access_rule_buttons.model_base +msgid "base" +msgstr "" + diff --git a/web_access_rule_buttons/models/__init__.py b/web_access_rule_buttons/models/__init__.py new file mode 100644 index 000000000..31660d6a9 --- /dev/null +++ b/web_access_rule_buttons/models/__init__.py @@ -0,0 +1,3 @@ +# License AGPL-3.0 or later (https://www.gnu.org/licenses/agpl). + +from . import models diff --git a/web_access_rule_buttons/models/models.py b/web_access_rule_buttons/models/models.py new file mode 100644 index 000000000..94d4fd85b --- /dev/null +++ b/web_access_rule_buttons/models/models.py @@ -0,0 +1,40 @@ +# Copyright 2016 Camptocamp SA +# License AGPL-3.0 or later (https://www.gnu.org/licenses/agpl). + +from odoo import exceptions, models + + +class Base(models.AbstractModel): + """ The base model, which is implicitly inherited by all models. """ + + _inherit = "base" + + def check_access_rule_all(self, operations=None): + """Verifies that the operation given by ``operations`` is allowed for + the user according to ir.rules. + + If ``operations`` is empty, it returns the result for all actions. + + :param operation: a list of ``read``, ``create``, ``write``, ``unlink`` + :return: {operation: access} (access is a boolean) + """ + if not operations or not any(operations): + operations = ["read", "create", "write", "unlink"] + result = {} + for operation in operations: + try: + self.check_access_rule(operation) + except exceptions.AccessError: + result[operation] = False + if ( + self.is_transient() + or self.ids + and self.env.user.has_group("base.user_admin") + ): + # If we call check_access_rule() without id, it will try to + # run a SELECT without ID which will crash, so we just blindly + # allow the operations + result[operation] = True + else: + result[operation] = False + return result diff --git a/web_access_rule_buttons/readme/CONTRIBUTORS.rst b/web_access_rule_buttons/readme/CONTRIBUTORS.rst new file mode 100644 index 000000000..830abe4c6 --- /dev/null +++ b/web_access_rule_buttons/readme/CONTRIBUTORS.rst @@ -0,0 +1,3 @@ +* Guewen Baconnier +* Antonio Esposito +* Dhara Solanki diff --git a/web_access_rule_buttons/readme/DESCRIPTION.rst b/web_access_rule_buttons/readme/DESCRIPTION.rst new file mode 100644 index 000000000..dd7a876da --- /dev/null +++ b/web_access_rule_buttons/readme/DESCRIPTION.rst @@ -0,0 +1,2 @@ +This addon disables the Edit button on the form views if the user +cannot edit the current record according to the record access rules. diff --git a/web_access_rule_buttons/readme/USAGE.rst b/web_access_rule_buttons/readme/USAGE.rst new file mode 100644 index 000000000..7a921d269 --- /dev/null +++ b/web_access_rule_buttons/readme/USAGE.rst @@ -0,0 +1,3 @@ +When using Odoo, even if a user has no rights to edit a record, the Edit button +is shown. The user can edit the record but won't be able to save his changes. +Now, the user won't be able to click on the Edit button. diff --git a/web_access_rule_buttons/static/description/icon.png b/web_access_rule_buttons/static/description/icon.png new file mode 100644 index 000000000..3a0328b51 Binary files /dev/null and b/web_access_rule_buttons/static/description/icon.png differ diff --git a/web_access_rule_buttons/static/description/index.html b/web_access_rule_buttons/static/description/index.html new file mode 100644 index 000000000..eafe7431e --- /dev/null +++ b/web_access_rule_buttons/static/description/index.html @@ -0,0 +1,429 @@ + + + + + + +Web Access Rules Buttons + + + +
+

Web Access Rules Buttons

+ + +

Beta License: AGPL-3 OCA/web Translate me on Weblate Try me on Runbot

+

This addon disables the Edit button on the form views if the user +cannot edit the current record according to the record access rules.

+

Table of contents

+ +
+

Usage

+

When using Odoo, even if a user has no rights to edit a record, the Edit button +is shown. The user can edit the record but won’t be able to save his changes. +Now, the user won’t be able to click on the Edit button.

+
+
+

Bug Tracker

+

Bugs are tracked on GitHub Issues. +In case of trouble, please check there if your issue has already been reported. +If you spotted it first, help us smashing it by providing a detailed and welcomed +feedback.

+

Do not contact contributors directly about support or help with technical issues.

+
+
+

Credits

+
+

Authors

+
    +
  • Camptocamp
    • +
  • Onestein
    • +
+
+
+

Contributors

+ +
+
+

Maintainers

+

This module is maintained by the OCA.

+Odoo Community Association +

OCA, or the Odoo Community Association, is a nonprofit organization whose +mission is to support the collaborative development of Odoo features and +promote its widespread use.

+

This module is part of the OCA/web project on GitHub.

+

You are welcome to contribute. To learn how please visit https://odoo-community.org/page/Contribute.

+
+
+
+ + diff --git a/web_access_rule_buttons/static/src/js/form_controller.js b/web_access_rule_buttons/static/src/js/form_controller.js new file mode 100644 index 000000000..0002f3338 --- /dev/null +++ b/web_access_rule_buttons/static/src/js/form_controller.js @@ -0,0 +1,32 @@ +/* Copyright 2016 Camptocamp SA + * License AGPL-3.0 or later (https://www.gnu.org/licenses/agpl). */ + +odoo.define("web_access_rule_buttons.main", function (require) { + "use strict"; + var FormController = require("web.FormController"); + FormController.include({ + async _update(state, params) { + return this._super(state, params).then(this.show_hide_buttons(state)); + }, + show_hide_buttons: function (state) { + var self = this; + return self + ._rpc({ + model: this.modelName, + method: "check_access_rule_all", + args: [[state.data.id], ["write"]], + }) + .then(function (accesses) { + self.show_hide_edit_button(accesses.write); + }); + }, + show_hide_edit_button: function (access) { + if (this.$buttons) { + var button = this.$buttons.find(".o_form_button_edit"); + if (button) { + button.prop("disabled", !access); + } + } + }, + }); +}); diff --git a/web_access_rule_buttons/tests/__init__.py b/web_access_rule_buttons/tests/__init__.py new file mode 100644 index 000000000..1c1376d5f --- /dev/null +++ b/web_access_rule_buttons/tests/__init__.py @@ -0,0 +1,3 @@ +# License LGPL-3.0 or later (https://www.gnu.org/licenses/lgpl.html). + +from . import test_access_rule_buttons diff --git a/web_access_rule_buttons/tests/test_access_rule_buttons.py b/web_access_rule_buttons/tests/test_access_rule_buttons.py new file mode 100644 index 000000000..0708507d1 --- /dev/null +++ b/web_access_rule_buttons/tests/test_access_rule_buttons.py @@ -0,0 +1,26 @@ +# Copyright 2019 Onestein BV +# License AGPL-3.0 or later (http://www.gnu.org/licenses/agpl). +from odoo.tests.common import TransactionCase + + +class TestAccessRuleButtons(TransactionCase): + def setUp(self): + super(TestAccessRuleButtons, self).setUp() + + self.curr_obj = self.env["res.currency"] + self.curr_record = self.env.ref("base.USD") + + def test_check_access_rule_1(self): + res = self.curr_obj.check_access_rule_all(["write"]) + self.assertFalse(res["write"]) + + def test_check_access_rule_2(self): + res = self.curr_record.check_access_rule_all(["write"]) + self.assertTrue(res["write"]) + + def test_check_access_rule_3(self): + res = self.curr_record.check_access_rule_all() + self.assertTrue(res["read"]) + self.assertTrue(res["create"]) + self.assertTrue(res["write"]) + self.assertTrue(res["unlink"]) diff --git a/web_access_rule_buttons/views/web_access_rule_buttons.xml b/web_access_rule_buttons/views/web_access_rule_buttons.xml new file mode 100644 index 000000000..c1b63c8bc --- /dev/null +++ b/web_access_rule_buttons/views/web_access_rule_buttons.xml @@ -0,0 +1,15 @@ + + +