Prevent access errors related to res.groups when saving a user (Numig…

…i#179)

admin_light_user/__manifest__.py

@@ -23,6 +23,7 @@
         'data.xml',
         'mask_admin_groups.xml',
         'security/ir.model.access.csv',
+        'security/extended_security_rule.xml',
     ],
     'installable': True,
 }

admin_light_user/security/extended_security_rule.xml

@@ -0,0 +1,19 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<odoo>
+
+    <!-- 
+        The ir.model.access.csv file contains an entry to allow editing a user group.
+        This entry is only there to prevent access errors when creating/updating a user.
+
+        Groups should not be editable by the admin light user.
+        Only real administration groups should have access.
+    -->
+    <record id="res_groups_rule" model="extended.security.rule">
+        <field name="model_id" ref="base.model_res_groups"/>
+        <field name="groups_id" eval="[(4, ref('base.group_system'))]"/>
+        <field name="perm_write" eval="1"/>
+        <field name="perm_create" eval="1"/>
+        <field name="perm_unlink" eval="1"/>
+    </record>
+
+</odoo>

admin_light_user/security/ir.model.access.csv

@@ -1,5 +1,5 @@
 id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink
-access_groups,Admin Light: res.groups,base.model_res_groups,group_user_management,1,0,0,0
+access_groups,Admin Light: res.groups,base.model_res_groups,group_user_management,1,1,0,0
 access_ir_model_access,Admin Light: ir.model.access,base.model_ir_model_access,group_user_management,1,0,0,0
 access_ir_module_category,Admin Light: ir.module.category,base.model_ir_module_category,group_user_management,1,0,0,0
 access_ir_rule,Admin Light: ir.rule,base.model_ir_rule,group_user_management,1,0,0,0