diff options
| author | Denis Ledoux <dle@odoo.com> | 2014-08-20 14:07:43 +0200 |
|---|---|---|
| committer | Denis Ledoux <dle@odoo.com> | 2014-08-20 14:08:25 +0200 |
| commit | 0fce350cf443cd7bd137e4daab6297ed6f4f9161 (patch) | |
| tree | 1d4002eef7e498bc26bca1d79d2cf9b738b075b3 /addons/web/static/src/xml/base.xml | |
| parent | 3ab268cf6384472b03f3e88273f31b4b6d99e9fc (diff) | |
[FIX] fields: *2many related fields should not be read as superuser
one2many and many2many fields depends on the security rules.
For instance, on products, with the taxes_id many2many fields, you only see the taxes of your own company, thanks to the multi company security rule
With related *2many fields, if you browse it with superuser, you will have all records of the one2many fields, even those you are not allowed to see, as superuser ignores security rules.
For instance, taxes_id of product.product is a related of taxes_id of product_template (through the inherits on product.template), and you should see the same taxes on the product template and on the product product (variant). This is not the case if the fields is read using the superuser
Diffstat (limited to 'addons/web/static/src/xml/base.xml')
0 files changed, 0 insertions, 0 deletions
