[FIX] Model.browse: prefetching should not include model-level restricted fields (with @groups)

This usually causes spurious AccessDenied errors that would
not have occurred in most cases because the restricted fields
would not be actually read/accessed.
This patch treats fields with model-level `groups` attributes
(which means access is restricted by the ORM, not just the UI)
as not prefetchable, irregardless of the actual groups that are
restricted. This agnostic  approach was chosen to save the
extra group membership lookup in most cases, which is currently
not cached (caching it would be a bigger change and come with
cache invalidation issues).

In the worst case the non-prefetching will cause an extra
SQL query for each restricted field that is browsed, but in
most cases this will make no performance hit, as this
from of access control is typically used only for a few
fields.

bzr revid: odo@openerp.com-20130820085451-e1a30wfod2hc52hf

0 files changed, 0 insertions, 0 deletions