From 61623bd17c48a1feb33246fd1c806e20281c1c37 Mon Sep 17 00:00:00 2001 From: "Lucas Perais (lpe)" Date: Mon, 14 Jan 2019 10:58:44 +0000 Subject: [FIX] fields: read/write company-dependent fields without ir.property access This is the first step to a more comprehensive handling of company-dependent fields which are ir_properties. With model-specific access rights, users should be able to read/update a company-dependent field no matter their access rights on ir_property. Before this commit, a user having access to res.partner, but not to ir.property couldn't write on property_account_receivable/payable just because he couldn't write the corresponding ir.property. After this commit, he can. OPW 1923345 --- odoo/addons/test_new_api/tests/test_new_fields.py | 11 +++++++++++ 1 file changed, 11 insertions(+) (limited to 'odoo/addons/test_new_api/tests') diff --git a/odoo/addons/test_new_api/tests/test_new_fields.py b/odoo/addons/test_new_api/tests/test_new_fields.py index 16758292937..a29f5d38292 100644 --- a/odoo/addons/test_new_api/tests/test_new_fields.py +++ b/odoo/addons/test_new_api/tests/test_new_fields.py @@ -528,6 +528,10 @@ class TestFields(common.TransactionCase): self.env['ir.property'].create({'name': 'foo', 'fields_id': field.id, 'value': 'default', 'type': 'char'}) + # assumption: users don't have access to 'ir.property' + accesses = self.env['ir.model.access'].search([('model_id.model', '=', 'ir.property')]) + accesses.write(dict.fromkeys(['perm_read', 'perm_write', 'perm_create', 'perm_unlink'], False)) + # create/modify a record, and check the value for each user record = self.env['test_new_api.company'].create({'foo': 'main'}) record.invalidate_cache() @@ -547,6 +551,13 @@ class TestFields(common.TransactionCase): self.assertEqual(record.sudo(user1).foo, False) self.assertEqual(record.sudo(user2).foo, 'default') + # set field with 'force_company' in context + record.sudo(user0).with_context(force_company=company1.id).foo = 'beta' + record.invalidate_cache() + self.assertEqual(record.sudo(user0).foo, 'main') + self.assertEqual(record.sudo(user1).foo, 'beta') + self.assertEqual(record.sudo(user2).foo, 'default') + # create company record and attribute company_record = self.env['test_new_api.company'].create({'foo': 'ABC'}) attribute_record = self.env['test_new_api.company.attr'].create({ -- cgit v1.2.3 From cd3790c4ea19efd6800284a6471158b9c75b29ca Mon Sep 17 00:00:00 2001 From: Raphael Collet Date: Fri, 18 Jan 2019 12:56:01 +0000 Subject: [FIX] models: check groups on inverse fields Before this, groups on non-stored inverse fields were not checked upon write. The impact on existing fields is pretty small, since the inverse methods of those fields are subject to access rights on the records they use. closes odoo/odoo#30356 --- odoo/addons/test_new_api/tests/test_new_fields.py | 30 +++++++++++++++++++++++ 1 file changed, 30 insertions(+) (limited to 'odoo/addons/test_new_api/tests') diff --git a/odoo/addons/test_new_api/tests/test_new_fields.py b/odoo/addons/test_new_api/tests/test_new_fields.py index a29f5d38292..ea0b8cdd69c 100644 --- a/odoo/addons/test_new_api/tests/test_new_fields.py +++ b/odoo/addons/test_new_api/tests/test_new_fields.py @@ -276,6 +276,16 @@ class TestFields(common.TransactionCase): self.assertEqual(record.bar, 'Ho') self.assertEqual(record.counts, {'compute': 0, 'inverse': 1}) + def test_13_inverse_access(self): + """ test access rights on inverse fields """ + foo = self.env['test_new_api.category'].create({'name': 'Foo'}) + user = self.env['res.users'].create({'name': 'Foo', 'login': 'foo'}) + self.assertFalse(user.has_group('base.group_system')) + # add group on non-stored inverse field + self.patch(type(foo).display_name, 'groups', 'base.group_system') + with self.assertRaises(AccessError): + foo.sudo(user).display_name = 'Forbidden' + def test_14_search(self): """ test search on computed fields """ discussion = self.env.ref('test_new_api.discussion_0') @@ -577,6 +587,26 @@ class TestFields(common.TransactionCase): self.assertEqual(attribute_record.bar, 'DEFDEF') self.assertFalse(self.env.has_todo()) + # add group on company-dependent field + self.assertFalse(user0.has_group('base.group_system')) + self.patch(type(record).foo, 'groups', 'base.group_system') + with self.assertRaises(AccessError): + record.sudo(user0).foo = 'forbidden' + + user0.write({'groups_id': [(4, self.env.ref('base.group_system').id)]}) + record.sudo(user0).foo = 'yes we can' + + # add ir.rule to prevent access on record + self.assertTrue(user0.has_group('base.group_user')) + model_id = self.env['ir.model'].search([('model', '=', record._name)]).id + rule = self.env['ir.rule'].create({ + 'model_id': model_id, + 'groups': [self.env.ref('base.group_user').id], + 'domain_force': str([('id', '!=', record.id)]), + }) + with self.assertRaises(AccessError): + record.sudo(user0).foo = 'forbidden' + def test_28_sparse(self): """ test sparse fields. """ record = self.env['test_new_api.sparse'].create({}) -- cgit v1.2.3 From cbdc8d864b2fe97d8de83fc7c8e13fdea779d00a Mon Sep 17 00:00:00 2001 From: "Lucas Perais (lpe)" Date: Mon, 14 Jan 2019 10:58:44 +0000 Subject: [FIX] fields: read/write company-dependent fields without ir.property access This is the first step to a more comprehensive handling of company-dependent fields which are ir_properties. With model-specific access rights, users should be able to read/update a company-dependent field no matter their access rights on ir_property. Before this commit, a user having access to res.partner, but not to ir.property couldn't write on property_account_receivable/payable just because he couldn't write the corresponding ir.property. After this commit, he can. OPW 1923345 --- odoo/addons/test_new_api/tests/test_new_fields.py | 11 +++++++++++ 1 file changed, 11 insertions(+) (limited to 'odoo/addons/test_new_api/tests') diff --git a/odoo/addons/test_new_api/tests/test_new_fields.py b/odoo/addons/test_new_api/tests/test_new_fields.py index 6739a47422b..4443b72abbf 100644 --- a/odoo/addons/test_new_api/tests/test_new_fields.py +++ b/odoo/addons/test_new_api/tests/test_new_fields.py @@ -669,6 +669,10 @@ class TestFields(common.TransactionCase): self.env['ir.property'].create({'name': 'foo', 'fields_id': field_tag_id.id, 'value': tag0, 'type': 'many2one'}) + # assumption: users don't have access to 'ir.property' + accesses = self.env['ir.model.access'].search([('model_id.model', '=', 'ir.property')]) + accesses.write(dict.fromkeys(['perm_read', 'perm_write', 'perm_create', 'perm_unlink'], False)) + # create/modify a record, and check the value for each user record = self.env['test_new_api.company'].create({ 'foo': 'main', @@ -722,6 +726,13 @@ class TestFields(common.TransactionCase): self.assertEqual(record.sudo(user1).foo, False) self.assertEqual(record.sudo(user2).foo, 'default') + # set field with 'force_company' in context + record.sudo(user0).with_context(force_company=company1.id).foo = 'beta' + record.invalidate_cache() + self.assertEqual(record.sudo(user0).foo, 'main') + self.assertEqual(record.sudo(user1).foo, 'beta') + self.assertEqual(record.sudo(user2).foo, 'default') + # create company record and attribute company_record = self.env['test_new_api.company'].create({'foo': 'ABC'}) attribute_record = self.env['test_new_api.company.attr'].create({ -- cgit v1.2.3 From 716a272480e649db721c081605368e1bccf8dc91 Mon Sep 17 00:00:00 2001 From: Raphael Collet Date: Fri, 18 Jan 2019 12:56:01 +0000 Subject: [FIX] models: check groups on inverse fields Before this, groups on non-stored inverse fields were not checked upon write. The impact on existing fields is pretty small, since the inverse methods of those fields are subject to access rights on the records they use. closes odoo/odoo#30357 --- odoo/addons/test_new_api/tests/test_new_fields.py | 29 +++++++++++++++++++++++ 1 file changed, 29 insertions(+) (limited to 'odoo/addons/test_new_api/tests') diff --git a/odoo/addons/test_new_api/tests/test_new_fields.py b/odoo/addons/test_new_api/tests/test_new_fields.py index 4443b72abbf..e409e6e310d 100644 --- a/odoo/addons/test_new_api/tests/test_new_fields.py +++ b/odoo/addons/test_new_api/tests/test_new_fields.py @@ -364,6 +364,16 @@ class TestFields(common.TransactionCase): self.assertEqual(record.bar3, 'C') self.assertCountEqual(log, ['compute']) + def test_13_inverse_access(self): + """ test access rights on inverse fields """ + foo = self.env['test_new_api.category'].create({'name': 'Foo'}) + user = self.env['res.users'].create({'name': 'Foo', 'login': 'foo'}) + self.assertFalse(user.has_group('base.group_system')) + # add group on non-stored inverse field + self.patch(type(foo).display_name, 'groups', 'base.group_system') + with self.assertRaises(AccessError): + foo.sudo(user).display_name = 'Forbidden' + def test_14_search(self): """ test search on computed fields """ discussion = self.env.ref('test_new_api.discussion_0') @@ -752,6 +762,25 @@ class TestFields(common.TransactionCase): self.assertEqual(attribute_record.bar, 'DEFDEF') self.assertFalse(self.env.has_todo()) + # add group on company-dependent field + self.assertFalse(user0.has_group('base.group_system')) + self.patch(type(record).foo, 'groups', 'base.group_system') + with self.assertRaises(AccessError): + record.sudo(user0).foo = 'forbidden' + + user0.write({'groups_id': [(4, self.env.ref('base.group_system').id)]}) + record.sudo(user0).foo = 'yes we can' + + # add ir.rule to prevent access on record + self.assertTrue(user0.has_group('base.group_user')) + rule = self.env['ir.rule'].create({ + 'model_id': self.env['ir.model']._get_id(record._name), + 'groups': [self.env.ref('base.group_user').id], + 'domain_force': str([('id', '!=', record.id)]), + }) + with self.assertRaises(AccessError): + record.sudo(user0).foo = 'forbidden' + def test_30_read(self): """ test computed fields as returned by read(). """ discussion = self.env.ref('test_new_api.discussion_0') -- cgit v1.2.3