From 4e6f1d78058fafa9811f82eb7eb38291b8a6a701 Mon Sep 17 00:00:00 2001 From: Raphael Collet Date: Tue, 15 Nov 2022 12:35:25 +0000 Subject: [PATCH] [FIX] core: invalidate the cache of forbidden records when raising AccessError Issue: checking access rules fetches some data in cache. Sometimes, accessing a forbidden record does not crash because of the data left in cache. This is the case when accessing a field on a record, like in the field accessor method: try: records._fetch_field(f) # (1) except AccessError: record._fetch_field(f) # (2) The field f is included in the data fetched to check access rules in the prefetch set of record (1). Therefore, when trying to fetch the same field in (2), there is nothing to fetch and no access error occurs. Part-of: odoo/odoo#112126 --- odoo/addons/base/models/ir_rule.py | 1 + odoo/fields.py | 2 ++ 2 files changed, 3 insertions(+) diff --git a/odoo/addons/base/models/ir_rule.py b/odoo/addons/base/models/ir_rule.py index 6fbadee77f0..f98acd36ded 100644 --- a/odoo/addons/base/models/ir_rule.py +++ b/odoo/addons/base/models/ir_rule.py @@ -203,6 +203,7 @@ class IrRule(models.Model): resolution_info = _("Contact your administrator to request access if necessary.") if not self.env.user.has_group('base.group_no_one') or not self.env.user.has_group('base.group_user'): + records.invalidate_recordset() return AccessError(f"{operation_error}\n\n{resolution_info}") # This extended AccessError is only displayed in debug mode. diff --git a/odoo/fields.py b/odoo/fields.py index f9e76c739c2..fd91d6d849e 100644 --- a/odoo/fields.py +++ b/odoo/fields.py @@ -1161,6 +1161,8 @@ class Field(MetaField('DummyField', (object,), {})): try: recs._fetch_field(self) except AccessError: + if len(recs) == 1: + raise record._fetch_field(self) if not env.cache.contains(record, self): raise MissingError("\n".join([