diff options
| author | Martin Trigaux <mat@odoo.com> | 2020-02-06 14:59:50 +0100 |
|---|---|---|
| committer | Martin Trigaux <mat@odoo.com> | 2020-05-14 13:59:10 +0200 |
| commit | ccc98e01691b88c2da9c484c0e6de235b9d18548 (patch) | |
| tree | 64b83aa240f633743a27404b1533a9c9d0e64896 /odoo/addons | |
| parent | ac9fb3b120b37d27e8bb2db4188decffa23540b9 (diff) | |
[IMP] base: remove read access to ir.ui.view
Only system users should be able to access directly ir.ui.view records
Other users should use helper methods like fields_view_get or render
to interact with view records (or use sudo)
Give read access to views to publisher
He needs to call read_template on some views like
'web_editor.colorpicker' in edition mode
Restrict ACL on website.page
Apply the same ACL than on ir.ui.view as the model inherits from it.
Give access to designer to modify views
Diffstat (limited to 'odoo/addons')
| -rw-r--r-- | odoo/addons/base/security/ir.model.access.csv | 2 | ||||
| -rw-r--r-- | odoo/addons/base/tests/test_views.py | 16 |
2 files changed, 16 insertions, 2 deletions
diff --git a/odoo/addons/base/security/ir.model.access.csv b/odoo/addons/base/security/ir.model.access.csv index a3405311a5f..328d36cc421 100644 --- a/odoo/addons/base/security/ir.model.access.csv +++ b/odoo/addons/base/security/ir.model.access.csv @@ -31,7 +31,7 @@ "access_ir_translation_group_system","ir_translation group_system","model_ir_translation","group_system",1,1,1,1 "access_ir_ui_menu_group_user","ir_ui_menu group_user","model_ir_ui_menu",base.group_user,1,0,0,0 "access_ir_ui_menu_group_system","ir_ui_menu group_system","model_ir_ui_menu","group_system",1,1,1,1 -"access_ir_ui_view_group_user","ir_ui_view group_user","model_ir_ui_view",,1,0,0,0 +"access_ir_ui_view_group_user","ir_ui_view group_user","model_ir_ui_view",,0,0,0,0 "access_ir_ui_view_group_system","ir_ui_view group_system","model_ir_ui_view","group_system",1,1,1,1 "access_reset_view_arch_wizard_group_system","reset_view_arch_wizard group_system","model_reset_view_arch_wizard","group_system",1,1,1,0 "access_ir_ui_view_custom_group_user","ir_ui_view_custom_group_user","model_ir_ui_view_custom",,1,1,1,1 diff --git a/odoo/addons/base/tests/test_views.py b/odoo/addons/base/tests/test_views.py index 599eb14387b..02ac6af18c2 100644 --- a/odoo/addons/base/tests/test_views.py +++ b/odoo/addons/base/tests/test_views.py @@ -9,7 +9,7 @@ from lxml import etree from lxml.builder import E from psycopg2 import IntegrityError -from odoo.exceptions import ValidationError +from odoo.exceptions import AccessError, ValidationError from odoo.tests import common from odoo.tools import mute_logger, view_validation from odoo.addons.base.models.ir_ui_view import ( @@ -2923,6 +2923,20 @@ class TestValidationTools(common.BaseCase): {'x', 'y', 'z'}, ) +class TestAccessRights(common.TransactionCase): + + @common.users('demo') + def test_access(self): + # a user can not access directly a view + with self.assertRaises(AccessError): + self.env['ir.ui.view'].search([("model", '=', "res.partner"), ('type', '=', 'form')]) + + # but can call fields_view_get + self.env['res.partner'].fields_view_get(view_type='form') + + # unless he does not have access to the model + with self.assertRaises(AccessError): + self.env['ir.ui.view'].fields_view_get(view_type='form') @common.tagged('post_install', '-at_install', '-standard', 'migration') class TestAllViews(common.TransactionCase): |