Fix security rules on activity types

security/security_rules.xml

@@ -123,12 +123,26 @@
             <field eval="True" name="global"/>
         </record>
 
+        <record id="mail_activity_type_rule_ur_readall" model="ir.rule">
+            <field name="name">read all mail activity type rule per ur</field>
+            <field name="model_id" ref="mail.model_mail_activity_type"/>
+            <field name="domain_force">['|',('ur_id','=',False),('ur_id','=',user.company_id.ur_id.id)]</field>
+            <field name="groups" eval="[(6, 0, [ref('base.group_user')])]"/>
+            <field name="perm_read" eval="True"/>
+            <field name="perm_write" eval="False"/>
+            <field name="perm_create" eval="False"/>
+            <field name="perm_unlink" eval="False"/>
+        </record>
+
         <record id="mail_activity_type_rule_ur" model="ir.rule">
             <field name="name">mail activity type rule per ur</field>
             <field name="model_id" ref="mail.model_mail_activity_type"/>
             <field name="domain_force">[('ur_id','=',user.company_id.ur_id.id)]</field>
             <field name="groups" eval="[(6, 0, [ref('base.group_user')])]"/>
-            <field eval="True" name="global"/>
+            <field name="perm_read" eval="False"/>
+            <field name="perm_write" eval="True"/>
+            <field name="perm_create" eval="True"/>
+            <field name="perm_unlink" eval="False"/>
         </record>
 
         <record id="mail_activity_type_rule_admin" model="ir.rule">