Putting in the data for a day/week time-sheet is ok.
After pressing the button "Submitting to the Manager' the Manager of course gets the ability to agree, but the user can do it same way directly afterwards with pressung the button 'Approve'.
The user hat NO manager rights, but always can appove himself.
This does not make any sense, as it should only be approvable by the manager. Otherwise the time-sheet of a employee can be changed/resetted back and forth anytime the user want it to do.
On the runbot the demo user can do the same,mentioned above, without manager rights.