User permissions and access rights in Odoo 10

Question

Hello.  I am running Odoo 10 CE. I have a user configured to be allowed
access only to sales related documents -- for use by a sales person.
The sales person should not have access to anything under Purchases.
Under Access Rights, the user has only been added to three security
groups:  Sales - User: All Documents, Accounting & Finance -
Billing, and Employees - Employee.  However, I just discovered that the
user can edit purchase orders created by Administrator.  While the
Purchases menu is not

subbarao · Accepted Answer

You are right Michael, But the problem is here
Accounting & Finance - Billing   user have create and write permissions for Purchase Order.
You can check it from Settings/technical/database structure/models
search for purchase order and check in access rights tab.

Michael Rutherford · Answer

Yes, thank you Subbarao. I found that later. I removed write access for the Billing security group in the ACL, as I don't believe a Billing user will need that access in this case. I was confused because I assumed that if a user wasn't added to a security group for Purchases, it would have no access to models under Purchases. I see now that is not a safe assumption. Thanks for your answer.

Aiheeseen liittyviä artikkeleita	Vastaukset	Näkymät
[V12] create Group to remove right to modify followers Ratkaistu security permissions access_rules access rights 12.	1 jouluk. 22	4608
Access per user and per record security access record_rules permissions userpermissions	0 kesäk. 17	3477
How to segregate contact records using record rules security record_rules permissions	2 marrask. 24	1338
Internal Users can't log into second website why? Ratkaistu users permissions userpermissions	2 maalisk. 24	5170
Allow "Write a note" and Send a message to users with no write access (Odoo 13) security access rights Odoo13	0 jouluk. 22	3141

Tämä kysymys on merkitty

Nautitko keskustelusta? Älä vain lue, vaan osallistu!