[6.0] new user - much too many access rights

[Ferdinand]

 Employee and Partner Manager are assigne by default to each new user
IMHO much to much ...
see screenshot ( I didn't check yet if an Employee sees only "his" payslip...) but he sees all other employees and can print ther attendence liste etc. a bit to much for my taste

IMHO only the bare necessary access rights should be given to a group "Login"

I think of users who should only have access to wiki or documents for example (external consultants)

[Purnendu Singh (OpenERP) (purnendu-singh)]

hello,

I fixed this bug for all hr_* modules in lp:~openerp-commiter/openobject-addons/trunk-dev-addons3-psi2 branch.

Revision no: 4649
Revision Id: <email address hidden>

Thanks
PSI

[Mustufa Rangwala (Open ERP) (mra-tinyerp)]

Purnendu,

For hr_expense not working

[Purnendu Singh (OpenERP) (purnendu-singh)]

Hello,

Changes for hr_expense is done, and it's working fine now.

Thanks

[Mustufa Rangwala (Open ERP) (mra-tinyerp)]

Addons3 team has done changes for hr modules.

For crm related module changes will be done by Addons1 Team.

thanks,
mra

[Atul Patel(OpenERP) (atp-openerp)]

Hello,

It has been fixed in https://code.launchpad.net/~openerp-dev/openobject-addons/trunk-bug-719063-atp branch for all crm_* Modules.

Revision no: 4424
Revision Id: <email address hidden>

Thanks

[tfr (Openerp) (tfr)]

this a choice made by us.

by default, new user should be usuable for the saas offer and little company that want to use openerp with a minimal configuration.
If it's a bigger company they just need to take few min to configure each user as they want

[Purnendu Singh (OpenERP) (purnendu-singh)]

hello,

As tfr(OpenERP) set this bug to won't fix, we are reverting all the change of hr_* modules from
lp:~openerp-dev/openobject-addons/trunk-dev-addons3 branch

Thanks
PSI

[Olivier Dony (Odoo) (odo-openerp)]

Wait, wait, this needs clarifications, it is not fully "won't fix". Here is a summary:

1. We do want new users to have "Employee" and "Partner Manager" groups by default, because this is a must have for users that are created for the purpose of giving access to colleagues in most SMB or SaaS deployments. This is the most common case, so it is the default.
2. For other specific cases (like giving access to external users), assigning (or removing) groups is part of setting up the new users, according to their profiles. Note that there is the "share" module specifically dedicated to sharing data with external users, and it takes care of the basic group/rule setup.
3. By default we want members of "Employee" to be able to see the list of Employees, because in most companies people need to access the "phone book" of the company, and this is how it is done. We have setup special view restrictions on Employee form, so that other Employees can only see basic contact info (phone, job position, picture). You need to be part of HR to see more than that.

We need to make everything consistent with these 3 rules, therefore normal Employees should not indeed be able to see the Payslips or Evaluations of other employees, this is for HR/User (i.e HR Officers) only.
Therefore, some of the patches done by addons3 team are good, but some are not (i.e. Employees must be able to see other Employees, but not all their data). I hope this clears up the situation.

Note to developers: please respect the new convention for naming bugfix branches (like atp) to make the review/merge task easier, and avoid putting everything in the same branch. See guidelines or contact your team leader for more explanations.

[Ferdinand (office-chricar)]

@Olivier
Just had a look into the access list of Emlpoyees and find
* accounting
* calendar
* crm
* hr
* mrp
* product
* project
* stock
without further invetigation and for more complex not SAAS I assume that a separation beween "Login" and "Employee" rights would ease a more complex setup
and a default SAAS employe could be member of 3 groups too

[tfr (Openerp) (tfr)]

This bug has been treated from addons1 team, is it ok for the team3, in this case we can release the bug.

[Priyesh (OpenERP) (pso-openerp)]

Hello,

According to Olivier's suggestion, I have made changes for timesheet and payslips. Its fixed in
https://code.launchpad.net/~openerp-dev/openobject-addons/trunk-bug-719063-pso

Rev-no: 4609
Revision-Id: <email address hidden>

This branch will be merged soon with Addons branch.

Thanks.

[qdp (OpenERP) (qdp)]

not at all commited... merge proposal disaprooved, i need explanation

[Ashvin Rathod (OpenERP) (ara-tinyerp)]

Hello,

Its fixed in lp:~openerp-dev/openobject-addons/trunk-bug-719063-pso branch. It will be merge soon with trunk addons.

Revision ID: <email address hidden>
Revision No: 4610

Thanks.

[Purnendu Singh (OpenERP) (purnendu-singh)]

Hello,

Its fixed in lp:~openerp-dev/openobject-addons/trunk-bug-719063-pso branch. It will be merge soon with trunk addons.

Revision ID: <email address hidden>
Revision No: 4611

Thanks.

[qdp (OpenERP) (qdp)]

We made most of what we decided. Before release of v6.1, we will clean and correct the access rights for HR module that only remains, but in the meanwhile and for the sake of clarity, let me set this bug as fix released.

thanks