Skip to content

Commit 2ae7ae0

Browse files
emjay0921emjay0921
committed
merge: bring branch up to date with 19.0 (clean merge, no conflicts)
2 parents 31a9554 + 6991217 commit 2ae7ae0

89 files changed

Lines changed: 2208 additions & 343 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎spp_area/README.rst‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -140,6 +140,25 @@ Dependencies
140140
Changelog
141141
=========
142142

143+
19.0.2.0.2
144+
~~~~~~~~~~
145+
146+
- fix(security): grant ``group_area_viewer`` (read-only) to
147+
spp_user_roles support roles (Global Support, Global Support Manager,
148+
Local Support) so they can browse area records per the OP#951 menu
149+
audit.
150+
151+
19.0.2.0.1
152+
~~~~~~~~~~
153+
154+
- fix(security): add a global ``ir.rule`` on ``res.partner`` that
155+
filters registrants by ``area_id`` for users with ``center_area_ids``
156+
set (OP#989). Replaces the limited ``search_read`` /
157+
``web_search_read`` override in ``models/registrant.py`` which missed
158+
``name_search`` (Many2one dropdowns), ``search_count``,
159+
``read_group``, and related-field traversal. The rule's conditional
160+
domain is a no-op for users without center areas (global roles).
161+
143162
19.0.2.0.0
144163
~~~~~~~~~~
145164

‎spp_area/__manifest__.py‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
"name": "OpenSPP Area Management",
77
"summary": "Establishes direct associations between OpenSPP registrants, beneficiary groups, and their corresponding geographical administrative areas. It validates registrant-area linkages against official area types, ensuring data integrity and enabling targeted program delivery and analysis.",
88
"category": "OpenSPP/Core",
9-
"version": "19.0.2.0.0",
9+
"version": "19.0.2.0.2",
1010
"sequence": 1,
1111
"author": "OpenSPP.org",
1212
"website": "https://github.com/OpenSPP/OpenSPP2",
@@ -33,6 +33,8 @@
3333
"security/privileges.xml",
3434
"security/groups.xml",
3535
"security/ir.model.access.csv",
36+
"data/user_roles.xml",
37+
"security/rules.xml",
3638
"wizard/area_import_language_wizard_views.xml",
3739
"views/area_base.xml",
3840
"views/area_tag.xml",

‎spp_area/data/user_roles.xml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
<?xml version="1.0" encoding="UTF-8" ?>
2+
<!--
3+
Part of OpenSPP. See LICENSE file for full copyright and licensing details.
4+
5+
Role extensions: grant `group_area_viewer` (read-only) to spp_user_roles support
6+
roles whose audited menu visibility should include "Area" (OP#951).
7+
8+
System Admin sees the menu via `spp_security.group_spp_admin` → `group_area_manager`.
9+
-->
10+
<odoo noupdate="1">
11+
<record id="spp_user_roles.global_role_support" model="res.users.role">
12+
<field name="implied_ids" eval="[Command.link(ref('group_area_viewer'))]" />
13+
</record>
14+
<record id="spp_user_roles.global_role_support_manager" model="res.users.role">
15+
<field name="implied_ids" eval="[Command.link(ref('group_area_viewer'))]" />
16+
</record>
17+
<record id="spp_user_roles.local_role_support" model="res.users.role">
18+
<field name="implied_ids" eval="[Command.link(ref('group_area_viewer'))]" />
19+
</record>
20+
</odoo>

‎spp_area/readme/HISTORY.md‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,11 @@
1+
### 19.0.2.0.2
2+
3+
- fix(security): grant `group_area_viewer` (read-only) to spp_user_roles support roles (Global Support, Global Support Manager, Local Support) so they can browse area records per the OP#951 menu audit.
4+
5+
### 19.0.2.0.1
6+
7+
- fix(security): add a global `ir.rule` on `res.partner` that filters registrants by `area_id` for users with `center_area_ids` set (OP#989). Replaces the limited `search_read` / `web_search_read` override in `models/registrant.py` which missed `name_search` (Many2one dropdowns), `search_count`, `read_group`, and related-field traversal. The rule's conditional domain is a no-op for users without center areas (global roles).
8+
19
### 19.0.2.0.0
210

311
- Initial migration to OpenSPP2

‎spp_area/security/rules.xml‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
<?xml version="1.0" encoding="utf-8" ?>
2+
<!--
3+
Part of OpenSPP. See LICENSE file for full copyright and licensing details.
4+
5+
Area-based row-level filtering for registrants (OP#989).
6+
7+
Replaces / strengthens the `_prepare_domain` override in models/registrant.py
8+
which only catches `search_read` / `web_search_read`. An ir.rule applies to
9+
every ORM read path automatically: `search`, `search_count`, `read_group`,
10+
`name_search` (Many2one dropdowns), `read`, and related-field traversal.
11+
12+
The rule is scoped to `is_registrant = True` only — non-registrant contacts
13+
(users' own partners, admins, companies, system bots, mail followers) must
14+
remain readable, otherwise every record using `message_partner_ids` /
15+
`message_follower_ids` blows up for local users with `center_area_ids`.
16+
17+
The conditional domain makes the rule a no-op for users without
18+
`center_area_ids` (global roles).
19+
-->
20+
<odoo noupdate="1">
21+
<record id="rule_res_partner_area_filter" model="ir.rule">
22+
<field name="name">Registrants: visible only within user's center areas</field>
23+
<field name="model_id" ref="base.model_res_partner" />
24+
<field
25+
name="domain_force"
26+
>['|', ('is_registrant', '=', False), ('area_id', 'child_of', user.center_area_ids.ids)] if user.center_area_ids else []</field>
27+
<field name="global" eval="True" />
28+
<field name="perm_read" eval="True" />
29+
<field name="perm_write" eval="True" />
30+
<field name="perm_create" eval="True" />
31+
<field name="perm_unlink" eval="True" />
32+
</record>
33+
</odoo>

‎spp_area/static/description/index.html‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -537,6 +537,27 @@ <h2><a class="toc-backref" href="#toc-entry-1">Changelog</a></h2>
537537
</div>
538538
</div>
539539
<div class="section" id="section-1">
540+
<h1>19.0.2.0.2</h1>
541+
<ul class="simple">
542+
<li>fix(security): grant <tt class="docutils literal">group_area_viewer</tt> (read-only) to
543+
spp_user_roles support roles (Global Support, Global Support Manager,
544+
Local Support) so they can browse area records per the OP#951 menu
545+
audit.</li>
546+
</ul>
547+
</div>
548+
<div class="section" id="section-2">
549+
<h1>19.0.2.0.1</h1>
550+
<ul class="simple">
551+
<li>fix(security): add a global <tt class="docutils literal">ir.rule</tt> on <tt class="docutils literal">res.partner</tt> that
552+
filters registrants by <tt class="docutils literal">area_id</tt> for users with <tt class="docutils literal">center_area_ids</tt>
553+
set (OP#989). Replaces the limited <tt class="docutils literal">search_read</tt> /
554+
<tt class="docutils literal">web_search_read</tt> override in <tt class="docutils literal">models/registrant.py</tt> which missed
555+
<tt class="docutils literal">name_search</tt> (Many2one dropdowns), <tt class="docutils literal">search_count</tt>,
556+
<tt class="docutils literal">read_group</tt>, and related-field traversal. The rule’s conditional
557+
domain is a no-op for users without center areas (global roles).</li>
558+
</ul>
559+
</div>
560+
<div class="section" id="section-3">
540561
<h1>19.0.2.0.0</h1>
541562
<ul class="simple">
542563
<li>Initial migration to OpenSPP2</li>

‎spp_base_common/README.rst‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -120,6 +120,21 @@ Dependencies
120120
Changelog
121121
=========
122122

123+
19.0.2.0.1
124+
~~~~~~~~~~
125+
126+
- fix(security): add ``groups="base.group_system"`` to the existing
127+
``<menuitem id="base.menu_management" />`` override in
128+
``views/main_view.xml``. Out of the box the Apps top-level menu has no
129+
group restriction and is visible to every logged-in user, violating
130+
the OP#951 audit's ``Apps: no`` rows. The override here is the single
131+
authoritative declaration for this menu's attributes in the OpenSPP
132+
install (sequence, custom OpenSPP icon, and now group_ids); doing the
133+
gating anywhere upstream (e.g. a ``post_init_hook`` in
134+
``spp_security``) is unreliable because this ``<menuitem>`` reload
135+
re-writes the record without a ``groups`` attribute and resets
136+
``group_ids`` to empty.
137+
123138
19.0.2.0.0
124139
~~~~~~~~~~
125140

‎spp_base_common/__manifest__.py‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55
{
66
"name": "OpenSPP Base (Common)",
77
"category": "OpenSPP/Core",
8-
"version": "19.0.2.0.0",
8+
"version": "19.0.2.0.1",
99
"sequence": 1,
1010
"author": "OpenSPP.org",
1111
"website": "https://github.com/OpenSPP/OpenSPP2",
@@ -38,6 +38,8 @@
3838
"spp_base_common/static/src/xml/custom_list_create_template.xml",
3939
"spp_base_common/static/src/js/filterable_radio_field.js",
4040
"spp_base_common/static/src/xml/filterable_radio_field.xml",
41+
"spp_base_common/static/src/xml/pager_hide_single.xml",
42+
"spp_base_common/static/src/scss/pager_hide_single.scss",
4143
],
4244
"web._assets_primary_variables": [
4345
"spp_base_common/static/src/scss/colors.scss",

‎spp_base_common/readme/HISTORY.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,7 @@
1+
### 19.0.2.0.1
2+
3+
- fix(security): add `groups="base.group_system"` to the existing `<menuitem id="base.menu_management" />` override in `views/main_view.xml`. Out of the box the Apps top-level menu has no group restriction and is visible to every logged-in user, violating the OP#951 audit's `Apps: no` rows. The override here is the single authoritative declaration for this menu's attributes in the OpenSPP install (sequence, custom OpenSPP icon, and now group_ids); doing the gating anywhere upstream (e.g. a `post_init_hook` in `spp_security`) is unreliable because this `<menuitem>` reload re-writes the record without a `groups` attribute and resets `group_ids` to empty.
4+
15
### 19.0.2.0.0
26

37
- Initial migration to OpenSPP2

‎spp_base_common/static/description/index.html‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -495,6 +495,22 @@ <h2><a class="toc-backref" href="#toc-entry-1">Changelog</a></h2>
495495
</div>
496496
</div>
497497
<div class="section" id="section-1">
498+
<h1>19.0.2.0.1</h1>
499+
<ul class="simple">
500+
<li>fix(security): add <tt class="docutils literal"><span class="pre">groups=&quot;base.group_system&quot;</span></tt> to the existing
501+
<tt class="docutils literal">&lt;menuitem <span class="pre">id=&quot;base.menu_management&quot;</span> /&gt;</tt> override in
502+
<tt class="docutils literal">views/main_view.xml</tt>. Out of the box the Apps top-level menu has no
503+
group restriction and is visible to every logged-in user, violating
504+
the OP#951 audit’s <tt class="docutils literal">Apps: no</tt> rows. The override here is the single
505+
authoritative declaration for this menu’s attributes in the OpenSPP
506+
install (sequence, custom OpenSPP icon, and now group_ids); doing the
507+
gating anywhere upstream (e.g. a <tt class="docutils literal">post_init_hook</tt> in
508+
<tt class="docutils literal">spp_security</tt>) is unreliable because this <tt class="docutils literal">&lt;menuitem&gt;</tt> reload
509+
re-writes the record without a <tt class="docutils literal">groups</tt> attribute and resets
510+
<tt class="docutils literal">group_ids</tt> to empty.</li>
511+
</ul>
512+
</div>
513+
<div class="section" id="section-2">
498514
<h1>19.0.2.0.0</h1>
499515
<ul class="simple">
500516
<li>Initial migration to OpenSPP2</li>

0 commit comments

Comments
 (0)