From 4a57166d189e7008316134857ebd68ed239e6ac1 Mon Sep 17 00:00:00 2001
From: David Dufresne <27902736+ddufresne@users.noreply.github.com>
Date: Mon, 9 Sep 2019 14:53:15 -0400
Subject: [PATCH] Prevent access errors related to res.groups when saving a
 user (#179)

---
 admin_light_user/__manifest__.py              |  1 +
 .../security/extended_security_rule.xml       | 19 +++++++++++++++++++
 admin_light_user/security/ir.model.access.csv |  2 +-
 3 files changed, 21 insertions(+), 1 deletion(-)
 create mode 100644 admin_light_user/security/extended_security_rule.xml

diff --git a/admin_light_user/__manifest__.py b/admin_light_user/__manifest__.py
index 3754991f..734401ca 100644
--- a/admin_light_user/__manifest__.py
+++ b/admin_light_user/__manifest__.py
@@ -23,6 +23,7 @@
         'data.xml',
         'mask_admin_groups.xml',
         'security/ir.model.access.csv',
+        'security/extended_security_rule.xml',
     ],
     'installable': True,
 }
diff --git a/admin_light_user/security/extended_security_rule.xml b/admin_light_user/security/extended_security_rule.xml
new file mode 100644
index 00000000..dc560437
--- /dev/null
+++ b/admin_light_user/security/extended_security_rule.xml
@@ -0,0 +1,19 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<odoo>
+
+    <!-- 
+        The ir.model.access.csv file contains an entry to allow editing a user group.
+        This entry is only there to prevent access errors when creating/updating a user.
+
+        Groups should not be editable by the admin light user.
+        Only real administration groups should have access.
+    -->
+    <record id="res_groups_rule" model="extended.security.rule">
+        <field name="model_id" ref="base.model_res_groups"/>
+        <field name="groups_id" eval="[(4, ref('base.group_system'))]"/>
+        <field name="perm_write" eval="1"/>
+        <field name="perm_create" eval="1"/>
+        <field name="perm_unlink" eval="1"/>
+    </record>
+
+</odoo>
diff --git a/admin_light_user/security/ir.model.access.csv b/admin_light_user/security/ir.model.access.csv
index 287ccf8b..eab11dea 100644
--- a/admin_light_user/security/ir.model.access.csv
+++ b/admin_light_user/security/ir.model.access.csv
@@ -1,5 +1,5 @@
 id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink
-access_groups,Admin Light: res.groups,base.model_res_groups,group_user_management,1,0,0,0
+access_groups,Admin Light: res.groups,base.model_res_groups,group_user_management,1,1,0,0
 access_ir_model_access,Admin Light: ir.model.access,base.model_ir_model_access,group_user_management,1,0,0,0
 access_ir_module_category,Admin Light: ir.module.category,base.model_ir_module_category,group_user_management,1,0,0,0
 access_ir_rule,Admin Light: ir.rule,base.model_ir_rule,group_user_management,1,0,0,0