From 3339d20520f7aeaa0fcfe6fe9ba1cd07d233acca Mon Sep 17 00:00:00 2001
From: Christophe Simonis <chs@odoo.com>
Date: Fri, 16 Jun 2017 14:22:27 +0200
Subject: [PATCH] [FIX] runbot: limit rebuild to runbot users

---
 runbot/runbot.xml                   | 6 +++---
 runbot/security/ir.model.access.csv | 1 +
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/runbot/runbot.xml b/runbot/runbot.xml
index e17703a8..3866d3e2 100644
--- a/runbot/runbot.xml
+++ b/runbot/runbot.xml
@@ -276,7 +276,7 @@
                 <a t-attf-href="https://#{repo.base}/commit/#{bu['name']}" class="btn btn-default"><i class="fa fa-github"/></a>
                 <button class="btn btn-default dropdown-toggle" data-toggle="dropdown"><i class="fa fa-cog"/><span class="caret"></span></button>
                 <ul class="dropdown-menu" role="menu">
-                    <li t-if="bu['result']=='skipped'">
+                    <li t-if="bu['result']=='skipped'" groups="runbot.group_runbot_admin">
                         <a href="#" class="runbot-rebuild" t-att-data-runbot-build="bu['id']">Force Build <i class="fa fa-level-up"></i></a>
                     </li>
                     <t t-if="bu['state']=='running'">
@@ -284,7 +284,7 @@
                         <li><a t-attf-href="http://{{bu['domain']}}/?db={{bu['real_dest']}}-base">Connect base <i class="fa fa-sign-in"></i></a></li>
                         <li><a t-attf-href="http://{{bu['domain']}}/">Connect <i class="fa fa-sign-in"></i></a></li>
                     </t>
-                    <li t-if="bu['state'] in ['done','running'] and bu_index==0">
+                    <li t-if="bu['state'] in ['done','running'] and bu_index==0" groups="runbot.group_user">
                         <a href="#" class="runbot-rebuild" t-att-data-runbot-build="bu['id']">Rebuild <i class="fa fa-refresh"/></a>
                     </li>
                     <li t-if="bu['state']!='testing' and bu['state']!='pending'" class="divider"></li>
@@ -572,7 +572,7 @@
                                 </div>
                               </form>
 
-                              <form class="navbar-form navbar-left form-inline" t-attf-action="/runbot/build/#{build['id']}/force" method='POST' t-if="request.params.get('ask_rebuild')">
+                              <form class="navbar-form navbar-left form-inline" t-attf-action="/runbot/build/#{build['id']}/force" method='POST' t-if="request.params.get('ask_rebuild')" groups="runbot.group_user">
                                 <a href='#' class="btn btn-danger runbot-rebuild" t-attf-data-runbot-build="#{build['id']}" > <i class='fa fa-refresh'/> Force Rebuild</a>
                               </form>
 
diff --git a/runbot/security/ir.model.access.csv b/runbot/security/ir.model.access.csv
index de4e5579..d6eebd3a 100644
--- a/runbot/security/ir.model.access.csv
+++ b/runbot/security/ir.model.access.csv
@@ -5,3 +5,4 @@ access_runbot_build,runbot_build,runbot.model_runbot_build,group_user,1,0,0,0
 access_runbot_repo_admin,runbot_repo_admin,runbot.model_runbot_repo,runbot.group_runbot_admin,1,1,1,1
 access_runbot_branch_admin,runbot_branch_admin,runbot.model_runbot_branch,runbot.group_runbot_admin,1,1,1,1
 access_runbot_build_admin,runbot_build_admin,runbot.model_runbot_build,runbot.group_runbot_admin,1,1,1,1
+access_irlogging,log by runbot users,base.model_ir_logging,group_user,0,0,1,0