Thank you, but there is no "mass mailing" in Windows Actions. The similar one (mail.compose.message) affects to all kind of mailings.

This should be the correct window action! Try to set User Groups. The Destination Model is 'mail.compose.message' and the action name is 'Mass Mailing'. But if you have another language than English then the action name is different.

OK, it seems that is in the same context {'default_composition_mode': 'mass_mail'}. And do you know where to find the export menuitem?

I have search for it and I only found it in the code of the 'web' module. It seams to be visible for every object and I did not find a way how to hide it. However if a user wants to export the data he/she could also copy and paste, it only takes longer than the export. What I want to say: If someone wants to export data you can not prevent him.

You are right, it's impossible to prevent it. For now what we did is to set the limit of records to view/select to 25 instead of the default of 80. So its only possible to export by 25 in 25.

Sorry, but that is not a good excuse. Just because somebody could manually copy one record at a time does not mean that you should allow them to export. Making the export feature an immutable item on every tree view menu is bad security. Atleast give administrators the ability to disable it completely for all users until a proper ACL scheme is implemented.

If someone has read access to a certain object he can also use the XMLRPC interface to read-out all values. So you can not prevent this.

yes, but you can disable XMLRPC read access.