Skip to Content
This question has been flagged
1 Reply
6374 Views
Avatar
Umashankar Subramani

Hi ,

    I am facing an issue, that is if i had a user who can view only sales menu , problem is if i tried to paste the url of other menu eg stock.move then it is showing the particular screen, How this can be blocked..... anyone give me a suggestion how to do this........

Avatar
Discard
Avatar
Michael Thomas
Best Answer

It sounds like he can't see the view, but have you changed his access rights to the stock.move model?

From the odoo documentation: 

Managed by the ir.model.access records, defines access to a whole model.

Each access control has a model to which it grants permissions, the permissions it grants and optionally a group.

Access controls are additive, for a given model a user has access all permissions granted to any of its groups: if the user belongs to group A which allows writing and group B which allows deleting, he can both write and delete.

If no group is specified, the access control applies to all users, otherwise it only applies to the users belonging to the specific group.

Available permissions are creation (perm_create), searching and reading (perm_read), updating existing records (perm_write) and deleting existing records (perm_unlink)

If you restrict the user's access to the stock.move model, for example, they should not be able to load the view without read permissions, even if they enter the URL to load the appropriate action. You can find Access Rights under Settings > Technical > Database Structure > Models > Select your Model > Access Rights. 

Furthermore, don't forget that permissions can be tricky. You need to make sure that every group that the user is a part of doesn't have access to that model. I ran a test to confirm and the user should get an access denied error message when they load the view. 

If you don't see this error and the view shows up check you permissions again. 

Avatar
Discard
Umashankar Subramani
Author

I have tested by giving stock.move model in access rights and set the permission to 0,0,0,0 ,but still that user views the stock.move url

Michael Thomas

I double checked. If I have a user that is a "warehouse user" and I remove access rights from the "warehouse user" group, then he loses access to that model. I suspect that whatever user you are trying to block is a member of multiple groups. So, he is able to see that model because one of his other groups has permission. You can try a test by creating a new user but only put him in the warehouse group and restrict rights to that group. Or, you can try removing the user your working with from any of the other groups he is in. Once you have the permissions set right, you should see this error: http://imgur.com/Tc7bz1p.png

Umashankar Subramani
Author

Thank you Michael Thomas......I got the issue cleared.....Thanks for your advice......

Diego Vázquez

That's partially correct in my opinion, Michael Thomas. If you creates a new employee user, and don't assign any permission else, this user will have read access to search (tree) / form view if you reproduces Umashankar example. And what if you want to create a new group of permissions with certain configuration permissions (e.g.) but you don't want this user to read views of neccesary models? How you avoid the user to load views pasting url on navigator or views load?