From 3ef96cd004ba30f34d7cd6627587afad3d58d923 Mon Sep 17 00:00:00 2001
From: Ludovic CHEVALIER <ludovic.chevalier@heureux-cyclage.org>
Date: Wed, 21 Sep 2016 12:19:16 +0200
Subject: [PATCH] [SECURITY] -pos box cash in pos box cash out access for non
 accountant or non pos manager users

---
 __openerp__.py         |  1 +
 view/point_of_sale.xml | 14 ++++++++++++++
 wizard/pos_box.xml     | 11 +++++++++++
 3 files changed, 26 insertions(+)
 create mode 100644 wizard/pos_box.xml

diff --git a/__openerp__.py b/__openerp__.py
index 8cdcc02..478c45e 100644
--- a/__openerp__.py
+++ b/__openerp__.py
@@ -42,6 +42,7 @@ It installs the profile for bike co-ops to manage some features like:
         'view/point_of_sale.xml',
         'security/velosenville.xml',
         'security/ir.model.access.csv',
+        'wizard/pos_box.xml',
     ],
     'installable': True,
     'auto_install': False,
diff --git a/view/point_of_sale.xml b/view/point_of_sale.xml
index a298887..872e4af 100644
--- a/view/point_of_sale.xml
+++ b/view/point_of_sale.xml
@@ -11,5 +11,19 @@
                 </xpath>
             </field>
         </record>
+        <record id="view_pos_session_form" model="ir.ui.view">
+            <field name="name">pos.session.form</field>
+            <field name="model">pos.session</field>
+            <field name="inherit_id" ref="point_of_sale.view_pos_session_form"/>
+            <field name="priority" eval="8"/>
+            <field name="arch" type="xml">
+            <xpath expr="//button[@name='%(point_of_sale.action_pos_box_in)d']" position="attributes">
+                <attribute name="groups">account.group_account_user,account.group_account_manager,point_of_sale.group_pos_manager</attribute>
+            </xpath>
+            <xpath expr="//button[@name='%(point_of_sale.action_pos_box_out)d']" position="attributes">
+                <attribute name="groups">account.group_account_user,account.group_account_manager,point_of_sale.group_pos_manager</attribute>
+            </xpath>
+            </field>
+        </record>
     </data>
 </openerp>
diff --git a/wizard/pos_box.xml b/wizard/pos_box.xml
new file mode 100644
index 0000000..81417dc
--- /dev/null
+++ b/wizard/pos_box.xml
@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<openerp>
+    <data>
+        <record id="point_of_sale.action_pos_box_in" model="ir.actions.act_window">
+            <field name="groups_id"  eval="[(4, ref('account.group_account_user')), (4, ref('account.group_account_manager')), (4, ref('point_of_sale.group_pos_manager'))]"/>
+        </record>
+        <record id="point_of_sale.action_pos_box_out" model="ir.actions.act_window">
+            <field name="groups_id"  eval="[(4, ref('account.group_account_user')), (4, ref('account.group_account_manager')), (4, ref('point_of_sale.group_pos_manager'))]"/>
+        </record>
+    </data>
+</openerp>
-- 
2.20.1