From 0d5fcdc1c7d13f3ac1d5868d7116b5c4e45a692c Mon Sep 17 00:00:00 2001 From: Johan Demaret Rivarola Date: Thu, 23 Jan 2020 09:42:28 +0000 Subject: [PATCH] [FIX] base: clear cache before read access check When reading binary content such as `image_128` on `res.users`, `AccessError` should be raised when necessary. Steps to reproduce: - Populate cache in superuser mode. - Access cached field with public user. - Read access is allowed but should not. Concrete example: - Unpublish `demo` user. - Access `/slides` with `public` user. - The template data is generated as `sudo`. - The same data is then accessed as `public`. - AccessError should be raised when requesting `/profile/avatar/` but is not. Closes #43826 closes odoo/odoo#45033 X-original-commit: e0112db4d6131751475365ab4c42de848f925dce Signed-off-by: Christophe Simonis --- odoo/addons/base/models/ir_http.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/odoo/addons/base/models/ir_http.py b/odoo/addons/base/models/ir_http.py index 35a3935f7be..1cc56cb0383 100644 --- a/odoo/addons/base/models/ir_http.py +++ b/odoo/addons/base/models/ir_http.py @@ -312,13 +312,13 @@ class IrHttp(models.AbstractModel): # eg: Allow to download an attachment on a task from /my/task/task_id record.check('read') record = record_sudo + + # check read access + try: # We have prefetched some fields of record, among which the field # 'write_date' used by '__last_update' below. In order to check # access on record, we have to invalidate its cache first. record._cache.clear() - - # check read access - try: record['__last_update'] except AccessError: return None, 403