diff options
| author | Jeremy Kersten <jke@odoo.com> | 2020-03-02 14:14:18 +0000 |
|---|---|---|
| committer | Martin Trigaux <mat@odoo.com> | 2020-03-21 10:23:32 +0000 |
| commit | 94f8f15036c3e5fec4aed9a7e50960bc7f190631 (patch) | |
| tree | d926cb95ab4641af45d4e96644c38b8d981fd413 /addons/website/security | |
| parent | 92f9d9b21b7bdde796e6105ee53f83d71fde3044 (diff) | |
[FIX] website: make handle_visibility private
This commit:
- make handle_visibility a private function (even if not
exploitable in rpc easily since it uses request.website)
- encrypt the password in db (even if not critic, since this
password could be shared on twitter, ... it doesn't cost anything
to secure it a bit more)
- remove useless sudo, since handle_visibility does a sudo itself.
In the future, this notion of visibility should be handled on controller layer,
and no more on the View layer (during rendering)
closes odoo/odoo#48145
X-original-commit: 06e0e48217f25f17dff23331111f5dcb98e8cecd
Signed-off-by: Martin Trigaux (mat) <mat@odoo.com>
Signed-off-by: Christophe Monniez (moc) <moc@odoo.com>
Diffstat (limited to 'addons/website/security')
| -rw-r--r-- | addons/website/security/website_security.xml | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/addons/website/security/website_security.xml b/addons/website/security/website_security.xml index e4113fbc717..60948552a0c 100644 --- a/addons/website/security/website_security.xml +++ b/addons/website/security/website_security.xml @@ -75,7 +75,7 @@ <record id="view_rule_visibility_public" model="ir.rule"> <field name="name">Website View Visibility Public</field> <field name="model_id" ref="base.model_ir_ui_view"/> - <field name="domain_force">[('type', '=', 'qweb'), ('visibility', 'in', ('public', False))]</field> + <field name="domain_force">['|', ('type', '!=', 'qweb'), ('visibility', 'in', ('public', False))]</field> <field name="perm_read" eval="True"/> <field name="perm_write" eval="False"/> <field name="perm_create" eval="False"/> @@ -85,7 +85,7 @@ <record id="view_rule_visibility_connected" model="ir.rule"> <field name="name">Website View Visibility Connected</field> <field name="model_id" ref="base.model_ir_ui_view"/> - <field name="domain_force">[('type', '=', 'qweb'), ('visibility', 'in', ('public', 'connected', False))]</field> + <field name="domain_force">['|', ('type', '!=', 'qweb'), ('visibility', 'in', ('public', 'connected', False))]</field> <field name="perm_read" eval="True"/> <field name="perm_write" eval="False"/> <field name="perm_create" eval="False"/> |