[FIX] base: mildly privileged user accessing partner form
A user in base.group_erp_manager (Access Rights) but NOT in base.group_system (Settings), will try to fetch the list of groups to generate selection fields to represent groups selection. As the method `_is_admin` only verifies the user belongs to group_erp_manager and the model ir.module.category requires group_system for read access rights, `fields_get` method tries to fetch the groups and fails with a security warning. The user fields are fetched when a res.partner form is loaded as the field user_ids (one2many) is present in the form view of partner in invisible. opw-672435
This commit is contained in:
@@ -945,7 +945,7 @@ class users_view(osv.osv):
|
||||
# add reified groups fields
|
||||
if not self.pool['res.users']._is_admin(cr, uid, [uid]):
|
||||
return res
|
||||
for app, kind, gs in self.pool['res.groups'].get_groups_by_application(cr, uid, context):
|
||||
for app, kind, gs in self.pool['res.groups'].get_groups_by_application(cr, SUPERUSER_ID, context):
|
||||
if kind == 'selection':
|
||||
# selection group field
|
||||
tips = ['%s: %s' % (g.name, g.comment) for g in gs if g.comment]
|
||||
|
||||
Reference in New Issue
Block a user