From a6ec6ca0e253a774d2c61f28bd3890b835892fbb Mon Sep 17 00:00:00 2001
From: Raphael Collet <rco@odoo.com>
Date: Tue, 17 Sep 2019 08:36:44 +0000
Subject: [PATCH] [FIX] models: do not prefetch forbidden fields in read()

closes odoo/odoo#36985

Signed-off-by: Raphael Collet (rco) <rco@openerp.com>
---
 odoo/models.py | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/odoo/models.py b/odoo/models.py
index 734dece8f30..92860de3c41 100644
--- a/odoo/models.py
+++ b/odoo/models.py
@@ -2822,7 +2822,9 @@ Fields:
             elif field.compute:
                 # optimization: prefetch direct field dependencies
                 for dotname in field.depends:
-                    stored_fields.add(dotname.split('.')[0])
+                    f = self._fields[dotname.split('.')[0]]
+                    if f.prefetch and (not f.groups or self.user_has_groups(f.groups)):
+                        stored_fields.add(f.name)
         self._read(stored_fields)
 
         # retrieve results from records; this takes values from the cache and