[FIX] base: mildly privileged user accessing partner form

A user in base.group_erp_manager (Access Rights) but NOT in base.group_system
(Settings), will try to fetch the list of groups to generate selection fields
to represent groups selection.

As the method `_is_admin` only verifies the user belongs to group_erp_manager
and the model ir.module.category requires group_system for read access rights,
`fields_get` method tries to fetch the groups and fails with a security warning.

The user fields are fetched when a res.partner form is loaded as the field
user_ids (one2many) is present in the form view of partner in invisible.

opw-672435
This commit is contained in:
Martin Trigaux
2016-03-24 18:15:32 +01:00
parent a23e850f63
commit 40a299c580
+1 -1
View File
@@ -945,7 +945,7 @@ class users_view(osv.osv):
# add reified groups fields
if not self.pool['res.users']._is_admin(cr, uid, [uid]):
return res
for app, kind, gs in self.pool['res.groups'].get_groups_by_application(cr, uid, context):
for app, kind, gs in self.pool['res.groups'].get_groups_by_application(cr, SUPERUSER_ID, context):
if kind == 'selection':
# selection group field
tips = ['%s: %s' % (g.name, g.comment) for g in gs if g.comment]