diff options
| -rw-r--r-- | odoo/addons/test_access_rights/__manifest__.py | 5 | ||||
| -rw-r--r-- | odoo/addons/test_access_rights/data.xml | 5 | ||||
| -rw-r--r-- | odoo/addons/test_access_rights/models.py | 5 | ||||
| -rw-r--r-- | odoo/addons/test_access_rights/tests/test_feedback.py | 43 | ||||
| -rw-r--r-- | odoo/models.py | 51 |
5 files changed, 104 insertions, 5 deletions
diff --git a/odoo/addons/test_access_rights/__manifest__.py b/odoo/addons/test_access_rights/__manifest__.py index bcccb90fd99..a44495cc54e 100644 --- a/odoo/addons/test_access_rights/__manifest__.py +++ b/odoo/addons/test_access_rights/__manifest__.py @@ -2,5 +2,8 @@ 'name': 'test of access rights and rules', 'description': "Testing of access restrictions", 'version': '0.0.1', - 'data': ['ir.model.access.csv'], + 'data': [ + 'ir.model.access.csv', + 'data.xml', + ], } diff --git a/odoo/addons/test_access_rights/data.xml b/odoo/addons/test_access_rights/data.xml new file mode 100644 index 00000000000..29fc5fdb290 --- /dev/null +++ b/odoo/addons/test_access_rights/data.xml @@ -0,0 +1,5 @@ +<odoo> + <record model="res.groups" id="test_group"> + <field name="name">Test Group</field> + </record> +</odoo> diff --git a/odoo/addons/test_access_rights/models.py b/odoo/addons/test_access_rights/models.py index 0d781e62ee6..3b575b30f17 100644 --- a/odoo/addons/test_access_rights/models.py +++ b/odoo/addons/test_access_rights/models.py @@ -9,6 +9,11 @@ class SomeObj(models.Model): val = fields.Integer() company_id = fields.Many2one('res.company') + forbidden = fields.Integer( + groups='test_access_rights.test_group,!base.group_no_one,base.group_user,!base.group_public', + default=5 + ) + forbidden2 = fields.Integer(groups='test_access_rights.test_group') class Container(models.Model): _name = 'test_access_right.container' diff --git a/odoo/addons/test_access_rights/tests/test_feedback.py b/odoo/addons/test_access_rights/tests/test_feedback.py index 0b104171ebe..4441eacfa9b 100644 --- a/odoo/addons/test_access_rights/tests/test_feedback.py +++ b/odoo/addons/test_access_rights/tests/test_feedback.py @@ -227,3 +227,46 @@ Note: this might be a multi-company issue. (records: [%s], uid: %d)""" % (self.record.id, self.user.id) ) + +class TestFieldGroupFeedback(Feedback): + + def setUp(self): + super().setUp() + self.record = self.env['test_access_right.some_obj'].create({ + 'val': 0, + }).sudo(self.user) + + + def test_read(self): + self.env.ref('base.group_no_one').write( + {'users': [(4, self.user.id)]}) + with self.assertRaises(AccessError) as ctx: + _ = self.record.forbidden + + self.assertEqual( + ctx.exception.args[0], + """The requested operation can not be completed due to security restrictions. + +Document type: Object For Test Access Right (test_access_right.some_obj) +Operation: read +Fields: +- forbidden (allowed for groups 'User types / Internal User', 'Test Group'; forbidden for groups 'Extra Rights / Technical Features', 'User types / Public')""" + ) + + def test_write(self): + self.env.ref('base.group_no_one').write( + {'users': [(4, self.user.id)]}) + + with self.assertRaises(AccessError) as ctx: + self.record.write({'forbidden': 1, 'forbidden2': 2}) + + self.assertEqual( + ctx.exception.args[0], + """The requested operation can not be completed due to security restrictions. + +Document type: Object For Test Access Right (test_access_right.some_obj) +Operation: write +Fields: +- forbidden (allowed for groups 'User types / Internal User', 'Test Group'; forbidden for groups 'Extra Rights / Technical Features', 'User types / Public') +- forbidden2 (allowed for groups 'Test Group')""" + ) diff --git a/odoo/models.py b/odoo/models.py index c0be9a53083..f82c052e331 100644 --- a/odoo/models.py +++ b/odoo/models.py @@ -2734,10 +2734,53 @@ class BaseModel(MetaModel('DummyModel', (object,), {'_register': False})): invalid_fields = {name for name in fields if not valid(name)} if invalid_fields: _logger.info('Access Denied by ACLs for operation: %s, uid: %s, model: %s, fields: %s', - operation, self._uid, self._name, ', '.join(invalid_fields)) - raise AccessError(_('The requested operation cannot be completed due to security restrictions. ' - 'Please contact your system administrator.\n\n(Document type: %s, Operation: %s)') % \ - (self._description, operation)) + operation, self._uid, self._name, ', '.join(invalid_fields)) + + description = self.env['ir.model']._get(self._name).name + if not self.env.user.has_group('base.group_no_one'): + raise AccessError( + _('The requested operation cannot be completed due to security restrictions. ' + 'Please contact your system administrator.\n\n(Document type: %(document_kind)s (%(document_model)s), Operation: %(operation)s)') % { + 'document_kind': description, + 'document_model': self._name, + 'operation': operation, + }) + + def format_groups(field): + anyof = self.env['res.groups'] + noneof = self.env['res.groups'] + for g in field.groups.split(','): + if g.startswith('!'): + noneof |= self.env.ref(g[1:]) + else: + anyof |= self.env.ref(g) + strs = [] + if anyof: + strs.append(_("allowed for groups %s") % ', '.join( + anyof.sorted(lambda g: g.id) + .mapped(lambda g: repr(g.display_name)) + )) + if noneof: + strs.append(_("forbidden for groups %s") % ', '.join( + noneof.sorted(lambda g: g.id) + .mapped(lambda g: repr(g.display_name)) + )) + return '; '.join(strs) + + raise AccessError(_("""The requested operation can not be completed due to security restrictions. + +Document type: %(document_kind)s (%(document_model)s) +Operation: %(operation)s +Fields: +%(fields_list)s""") % { + 'document_model': self._name, + 'document_kind': description or self._name, + 'operation': operation, + 'fields_list': '\n'.join( + '- %s (%s)' % (f, format_groups(self._fields[f])) + for f in sorted(invalid_fields) + ) + }) return fields |