From bed06b6fe52c2703da57948dd3adb6fd5945d72c Mon Sep 17 00:00:00 2001
From: Bertrand Chenal <bch@b2ck.com>
Date: Tue, 14 Oct 2008 19:28:41 +0200
Subject: [PATCH] Fix access: * Allow admin user to create requests and rely on
 the overloading of create . * Use same acces for cron user. * Disallow other
 user to write on purchase request.

---
 purchase_request.xml | 18 +++++++-----------
 1 file changed, 7 insertions(+), 11 deletions(-)

diff --git a/purchase_request.xml b/purchase_request.xml
index fa83f686dc..541c6b0643 100644
--- a/purchase_request.xml
+++ b/purchase_request.xml
@@ -156,22 +156,14 @@
         <record model="ir.model.access" id="access_purchase_request">
             <field name="model" search="[('model', '=', 'purchase.request')]"/>
             <field name="perm_read" eval="True"/>
-            <field name="perm_write" eval="True"/>
-            <field name="perm_create" eval="False"/>
-            <field name="perm_delete" eval="True"/>
-        </record>
-        <record model="ir.model.access" id="access_purchase_request_admin">
-            <field name="model" search="[('model', '=', 'purchase.request')]"/>
-            <field name="group" ref="purchase.group_purchase"/>
-            <field name="perm_read" eval="True"/>
-            <field name="perm_write" eval="True"/>
+            <field name="perm_write" eval="False"/>
             <field name="perm_create" eval="False"/>
             <field name="perm_delete" eval="True"/>
         </record>
         <record model="res.group" id="group_purchase_request">
-            <field name="name">Purchase Request Cron</field>
+            <field name="name">Purchase Request</field>
         </record>
-        <record model="ir.model.access" id="access_purchase_request_cron">
+        <record model="ir.model.access" id="access_purchase_request_admin">
             <field name="model" search="[('model', '=', 'purchase.request')]"/>
             <field name="group" ref="group_purchase_request"/>
             <field name="perm_read" eval="True"/>
@@ -180,6 +172,10 @@
             <field name="perm_delete" eval="True"/>
         </record>
 
+        <record model="res.user" id="res.user_admin">
+            <field name="groups" eval="[('add', ref('group_purchase_request'))]"/>
+        </record>
+
         <record model="res.user" id="user_generate_request">
             <field name="login">user_cron_purchase_request</field>
             <field name="name">Cron Purchase Request</field>