[FIX] rating: security issue to the last_value related field depends

The `rating_last_value` field was a related on the One2many
field `rating_ids`, on which the domain
`[('res_model', '=', self._name)]` is applied.

The problem is that this domain is not taken into account
when retrieving the records for which this value must be recomputed

Therefore, when computing the `rating_last_value` of a record,
if there was a record with the same `res_id` but another
`res_model`, the `rating_last_value` of this other record
is recomputed as well.

And, if you did not have the write access rights on this other
record, it raised a security exception.

There is at the moment no way in the ORM to filter the
depends on a specific subset of records for which
a computed field must be recomputed. Therefore,
we have no other choices to make the recomputation
of the records value as sudo. It will
recompute the value of other records which have nothing
to do with the one on which this value must be recomputed
(nothing to do except the id of the records which is common),
but at least it will succeed.

opw-709349

0 files changed, 0 insertions, 0 deletions