Odoo/odoo/addons/test_access_rights/security.xml, branch 14.0 The current checkout of upstream Odoo [IMP] *: declare ir.rule in noupdate 2020-03-20T15:21:25+00:00 Victor Feyens vfe@odoo.com 2020-03-10T17:07:12+00:00 a3ded9043d34229e4547e16625a86dfbebdbcfaf ir.rule are default values but can be customized based on the company's policy and needs. This is typically a record that is in noupdate as should be customization-friendly. 
ir.rule are default values but can be customized based on the
company's policy and needs.
This is typically a record that is in noupdate as should be
customization-friendly.
[FIX] models, test_access_rights: restore normal ACL check 2019-10-11T18:27:30+00:00 Nans Lefebvre len@odoo.com 2019-10-08T12:34:40+00:00 60534c65ae1ea65a86fa12b344a4a0f55c41d8f6 Because of 4b1cb41cf7a3f936a1e6d00a2bb6a6a29e82d711, we might try to read the field 'active' on a record on which we can't read fields besides the name. This thus triggers an access error where there should not have been. In particular, this is the case for portal users: most often the records they can access point to records that they can't read (e.g. the partner of the internal user assigned to the ticket). As a result, clicking on any link creates an ACL, and thus redirects to the home page. It turns out that filtered_domain was primarily used on already loaded records, typically for the write, so it was assumed that the records could be read in the first place. However in the use-case of the portal, there is an explicit check on the read rights with the portal user, explaining the discrepancy. Since in the general case filtered_domain should be able to read all fields to evaluate the domain, we put it in sudo. fix co-authored with @rco closes odoo/odoo#38540 X-original-commit: cff5cc8cc78a32eb204368e84ec4980324046405 Signed-off-by: Nans Lefebvre (len) <len@odoo.com> 
Because of 4b1cb41cf7a3f936a1e6d00a2bb6a6a29e82d711, we might try to read
the field 'active' on a record on which we can't read fields besides the name.
This thus triggers an access error where there should not have been.

In particular, this is the case for portal users: most often the records they
can access point to records that they can't read
(e.g. the partner of the internal user assigned to the ticket).
As a result, clicking on any link creates an ACL, and thus redirects to the
home page.

It turns out that filtered_domain was primarily used on already loaded records,
typically for the write, so it was assumed that the records could be read
in the first place.
However in the use-case of the portal, there is an explicit check on the read
rights with the portal user, explaining the discrepancy.

Since in the general case filtered_domain should be able to read all fields
to evaluate the domain, we put it in sudo.

fix co-authored with @rco

closes odoo/odoo#38540

X-original-commit: cff5cc8cc78a32eb204368e84ec4980324046405
Signed-off-by: Nans Lefebvre (len) <len@odoo.com>