[FIX] mail: Reserve mis-referenced trackings to system users
Purpose ======= Let's say that the field 'foo' is tracked and defined with a res.group. When the field is modified, a mail.tracking.value is generated, but the reference to the field name is a char field. When displaying the mail.tracking.values on the chatter, a check is done according to the field group to decide whether we should display it or not to the user. See: odoo/odoo@c7aa8c5#diff-ad8b6db158187579d2208f233d993c3cR43 So if I rename the field, and if the mail.tracking.value is not modified, the mail.tracking.value magically appears to the users who shouldn't access it before. Note: If the migration is correctly handled, this shouldn't be the case. But manual manipulations on the database could lead to this issue. Specification ============= If the field referenced by the mail_tracking_value doesn't seem to exist, then display its value to system users only, by security. closes odoo/odoo#39033 Taskid: 2088634 X-original-commit: ae1e70eba10112170283cfc17fa95d94dd948d2b Signed-off-by: Yannick Tivisse (yti) <yti@odoo.com>
This commit is contained in:
@@ -40,7 +40,7 @@ class MailTracking(models.Model):
|
||||
for tracking in self:
|
||||
model = self.env[tracking.mail_message_id.model]
|
||||
field = model._fields.get(tracking.field)
|
||||
tracking.field_groups = field.groups
|
||||
tracking.field_groups = field.groups if field else 'base.group_system'
|
||||
|
||||
@api.model
|
||||
def create_tracking_values(self, initial_value, new_value, col_name, col_info, tracking_sequence):
|
||||
|
||||
Reference in New Issue
Block a user