This update closes a permissions gap that could allow employees to change approved expense information when they should only be able to edit drafts. It helps protect approved expense records from unauthorized changes and strengthens expense approval controls.

The state changes right check was only done on specific method but it wasn't check at write level. Which allowed to bypass it.

The record rule on hr_expense_user without a check on the state is in draft allow to change data on approved expense sheets.


forward port : #189360

This fixes access control around salary contract pages so users can only view or interact with contracts they are allowed to access. It helps protect sensitive employee compensation information and reduces the risk of unauthorized exposure.

Backport: b642714d658d7180ab70ea171ad006e975c36449

task-4881974

Forward-Port-Of: odoo/enterprise#88776
Forward-Port-Of: odoo/enterprise#88489