[FIX] partner_category_security: Update ACL to prevent users with Publisher permission from write contact tags.

TT38576

partner_category_security/security/ir.model.access.csv

@@ -1,4 +1,4 @@
 id,name,model_id/id,group_id/id,perm_read,perm_write,perm_create,perm_unlink
-access_res_partner_category_user,res_partner_category_user,base.model_res_partner_category,group_partner_category_user,1,1,0,0
+access_res_partner_category_user,res_partner_category_user,base.model_res_partner_category,group_partner_category_user,1,0,0,0
 access_res_partner_category_manager,res_partner_category_manager,base.model_res_partner_category,group_partner_category_manager,1,1,1,1
 base.access_res_partner_category_group_partner_manager,res_partner_category group_partner_manager,base.model_res_partner_category,base.group_partner_manager,1,0,0,0

partner_category_security/tests/test_partner_category_security.py

@@ -36,7 +36,7 @@ class TestPartnerCategorySecurity(common.SavepointCase):
     def test_check_access_rights_partner_category_user(self):
         model = self.partner_category_model.with_user(self.partner_category_user)
         self.assertTrue(model.check_access_rights("read", False))
-        self.assertTrue(model.check_access_rights("write", False))
+        self.assertFalse(model.check_access_rights("write", False))
         self.assertFalse(model.check_access_rights("create", False))
         self.assertFalse(model.check_access_rights("unlink", False))