From 268d8b830eec744eb1b366216841243db2da3168 Mon Sep 17 00:00:00 2001 From: Raphael Collet Date: Wed, 20 Mar 2024 10:36:33 +0100 Subject: [PATCH] [FIX] base: don't check access rules on new records MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This fixes an issue where access rules are checked on a new record: the rule domains are evaluated with method filtered_domain(), and one rule uses the operator 'child_of', which is implemented with a call to search(). When used with a new record, filtered_domain() returns an empty recordset instead of the record itself. By design, the ORM doesn't check security on new records. A base automation of type 'onchange' will run some server action on a new record. The server action may still check access rights on the model, but should not check access rules. closes odoo/odoo#158309 Signed-off-by: Rémy Voet (ryv) --- odoo/addons/base/models/ir_actions.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/odoo/addons/base/models/ir_actions.py b/odoo/addons/base/models/ir_actions.py index 414c7c2852d..b9816cfe619 100644 --- a/odoo/addons/base/models/ir_actions.py +++ b/odoo/addons/base/models/ir_actions.py @@ -924,7 +924,9 @@ class IrActionsServer(models.Model): eval_context = self._get_eval_context(action) records = eval_context.get('record') or eval_context['model'] records |= eval_context.get('records') or eval_context['model'] - if records: + if records.ids: + # check access rules on real records only; base automations of + # type 'onchange' can run server actions on new records try: records.check_access_rule('write') except AccessError: