Restricted administration rights

by ,
Odoo          
v 10.0 Third Party 93

30.00 €

You bought this module and need support ? Click here !
Technical name access_restricted
LicenseLGPL-3
Websitehttps://twitter.com/yelizariev
Read description for v 12.0 v 11.0 v 9.0 v 8.0
Included Dependencies

Restricted administration rights

The module makes impossible for administrator to set (and see) more access rights (groups) than he already has. The only partial exception of this rule is made if you are already a member of the 'Allow add implied groups from settings' security group. Then you are allowed to escalate your privileges but just from Settings menus (by means of group_XXX boolean fields of res.config.settings models views).

This doesn't affect superuser, of course.

Typical usage of the module.

The superuser creates an administrator user without access group "Show Apps Menu" (see access_apps module). Then the administrator has access to settings, but not able to install new apps (without this module he can add himself to "Show Apps Menu" and get access to apps).

Tested on 10.0 5f0b7942d551f441aa41e75ee06f2dd163a9c6f6

Restricted administration rights

Installation

  • Install this module in a usual way

Configuration

  • By default all users except a superuser restricted to escalate the privileges
  • There is only one configuration option this module provides. Open menu [[ Settings  ]] >> Users >> Users
  • In Access Rights tab you can select 'Allow add implied groups from settings' - to allow some users to configurate modules by means of group_XXX fields from Settings menus

Usage

Let's take Sale module as an example.

Without this module installed:

  • Say you have a user with administration rights Administration: Access Rights. This user thus may increase his own rights in Application > Sales from Sales: User: All Documents to Sales: Manager. Also he can open menu [[ Sales ]] >> Configuration >> Settings and select Display 3 fields on sales orders: customer, invoice address, delivery address there and then click [Apply] button (adding group_sale_delivery_address)

With this module installed:

  • The user from previous example cannot increase his privileges. There is no Sales: Manager option for him, and also no Display 3 fields on sales orders: customer, invoice address, delivery address option in mudule configuration
  • The only exception is done for users who are in special group 'Allow add implied groups from settings' - if your user is included in this group by the superuser then you may select Display 3 fields on sales orders: customer, invoice address, delivery address from Sale module Configuration >> Settings menu

Please log in to comment on this module