diff options
| author | Johan Demaret Rivarola <jde@odoo.com> | 2020-01-23 09:42:28 +0000 |
|---|---|---|
| committer | Johan Demaret Rivarola <jde@odoo.com> | 2020-02-10 17:43:11 +0000 |
| commit | 0d5fcdc1c7d13f3ac1d5868d7116b5c4e45a692c (patch) | |
| tree | 18b9948bdf5c78ae35624b825ec4513a63fff19f /addons/note/data/note_data.xml | |
| parent | 7cc6fdf36569be85e995c962321f2926822ac604 (diff) | |
[FIX] base: clear cache before read access check
When reading binary content such as `image_128` on `res.users`,
`AccessError` should be raised when necessary.
Steps to reproduce:
- Populate cache in superuser mode.
- Access cached field with public user.
- Read access is allowed but should not.
Concrete example:
- Unpublish `demo` user.
- Access `/slides` with `public` user.
- The template data is generated as `sudo`.
- The same data is then accessed as `public`.
- AccessError should be raised when requesting
`/profile/avatar/<int:user_id>` but is not.
Closes #43826
closes odoo/odoo#45033
X-original-commit: e0112db4d6131751475365ab4c42de848f925dce
Signed-off-by: Christophe Simonis <chs@odoo.com>
Diffstat (limited to 'addons/note/data/note_data.xml')
0 files changed, 0 insertions, 0 deletions