diff options
| author | Martin Trigaux <mat@odoo.com> | 2020-10-15 07:57:09 +0000 |
|---|---|---|
| committer | Martin Trigaux <mat@odoo.com> | 2020-10-29 08:56:27 +0000 |
| commit | b0028c05d6ba9c67f16992ddb446eea6a854d099 (patch) | |
| tree | 2484c614e6b7c722a2268a8fdf77bd239a46fa72 /odoo/addons/base/security | |
| parent | 33a7142f298eeda7808d6d07e80231836442a0ce (diff) | |
[FIX] base: verify the rights on individual records too
The access rights of a model was checked but not the records themself.
In case a user has access to a model but not to a specific record, he
should not be able to execute a server action on it.
Correct the ir.rule on private partners to be also verified for other
operations than read.
While it was not possible to actually write on it (due to side effects
of ORM where write implies a read operation),
check_access_rule('write') was working on a private address
closes odoo/odoo#59740
Signed-off-by: Martin Trigaux (mat) <mat@odoo.com>
Diffstat (limited to 'odoo/addons/base/security')
| -rw-r--r-- | odoo/addons/base/security/base_security.xml | 12 |
1 files changed, 6 insertions, 6 deletions
diff --git a/odoo/addons/base/security/base_security.xml b/odoo/addons/base/security/base_security.xml index b70806b4d4f..3f36e7b17ee 100644 --- a/odoo/addons/base/security/base_security.xml +++ b/odoo/addons/base/security/base_security.xml @@ -85,9 +85,9 @@ (4, ref('base.group_user')), ]"/> <field name="perm_read" eval="True"/> - <field name="perm_write" eval="False"/> - <field name="perm_create" eval="False"/> - <field name="perm_unlink" eval="False"/> + <field name="perm_write" eval="True"/> + <field name="perm_create" eval="True"/> + <field name="perm_unlink" eval="True"/> </record> <!-- Relex previous rule for group_private_addresses --> <record id="res_partner_rule_private_group" model="ir.rule"> @@ -100,9 +100,9 @@ (4, ref('base.group_private_addresses')) ]"/> <field name="perm_read" eval="True"/> - <field name="perm_write" eval="False"/> - <field name="perm_create" eval="False"/> - <field name="perm_unlink" eval="False"/> + <field name="perm_write" eval="True"/> + <field name="perm_create" eval="True"/> + <field name="perm_unlink" eval="True"/> </record> <!-- Restrict modifications on ir.filters to owner only --> |