From 7b8038c4bd8bd24b6028e747d554b9f0da879134 Mon Sep 17 00:00:00 2001 From: Kevin Baptiste Date: Fri, 18 Oct 2019 09:30:21 +0000 Subject: [PATCH] [FIX] mail: Reserve mis-referenced trackings to system users Purpose ======= Let's say that the field 'foo' is tracked and defined with a res.group. When the field is modified, a mail.tracking.value is generated, but the reference to the field name is a char field. When displaying the mail.tracking.values on the chatter, a check is done according to the field group to decide whether we should display it or not to the user. See: odoo/odoo@c7aa8c5#diff-ad8b6db158187579d2208f233d993c3cR43 So if I rename the field, and if the mail.tracking.value is not modified, the mail.tracking.value magically appears to the users who shouldn't access it before. Note: If the migration is correctly handled, this shouldn't be the case. But manual manipulations on the database could lead to this issue. Specification ============= If the field referenced by the mail_tracking_value doesn't seem to exist, then display its value to system users only, by security. closes odoo/odoo#39033 Taskid: 2088634 X-original-commit: ae1e70eba10112170283cfc17fa95d94dd948d2b Signed-off-by: Yannick Tivisse (yti) --- addons/mail/models/mail_tracking_value.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/addons/mail/models/mail_tracking_value.py b/addons/mail/models/mail_tracking_value.py index 1651d4b6002..a35d10c9c0c 100644 --- a/addons/mail/models/mail_tracking_value.py +++ b/addons/mail/models/mail_tracking_value.py @@ -40,7 +40,7 @@ class MailTracking(models.Model): for tracking in self: model = self.env[tracking.mail_message_id.model] field = model._fields.get(tracking.field) - tracking.field_groups = field.groups + tracking.field_groups = field.groups if field else 'base.group_system' @api.model def create_tracking_values(self, initial_value, new_value, col_name, col_info, tracking_sequence):