pengyuthon/odoo_source
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[FIX] mail, base: move user settings access rules

Browse Source 
In b1e2c3453f50cc05a1b03dc1c8571a01ad7b7dd2, the `res.users.settings`
model was moved from `mail/` to `base/`, but its record rules remained
in `mail/`. This means that if `mail/` is not installed, users will be
able to access other users' `res.users.settings` records. In practice,
this is not a problem, as the only field that can exist in
`res.users.settings` without `mail/` is `homemenu_config`, which
contains nothing senstive.

This commit moves the forgotten record rules to `base/`, preventing
potential problems if new fields with sensitive information were to be
added to `res.users.settings` in the future.

Task-3461652

closes odoo/odoo#131538

X-original-commit: 5a79550c8e35ce733375c2ef7df2ea12e6added6
Signed-off-by: Louis Wicket (wil) <wil@odoo.com>
This commit is contained in:
Julien Carion (juca)
2023-08-10 18:14:36 +02:00
committed by Louis Wicket (wil)
parent b02a325a4f
commit d1c6bc5d95
2 changed files with 23 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files
addons/mail/security/mail_security.xml
-22
View File
@@ -129,28 +129,6 @@
<field name="perm_unlink" eval="True"/>
</record>
<record id="res_users_settings_rule_admin" model="ir.rule">
<field name="name">Administrators can access all User Settings.</field>
<field name="model_id" ref="model_res_users_settings"/>
<field name="groups" eval="[Command.link(ref('base.group_system'))]"/>
<field name="domain_force">[(1, '=', 1)]</field>
<field name="perm_read" eval="True"/>
<field name="perm_write" eval="True"/>
<field name="perm_create" eval="True"/>
<field name="perm_unlink" eval="True"/>
</record>
<record id="res_users_settings_rule_user" model="ir.rule">
<field name="name">res.users.settings: access their own entries</field>
<field name="model_id" ref="model_res_users_settings"/>
<field name="groups" eval="[Command.link(ref('base.group_user'))]"/>
<field name="domain_force">[('user_id', '=', user.id)]</field>
<field name="perm_read" eval="True"/>
<field name="perm_write" eval="True"/>
<field name="perm_create" eval="True"/>
<field name="perm_unlink" eval="True"/>
</record>
<record id="res_users_settings_volumes_rule_user" model="ir.rule">
<field name="name">res.users.settings.volumes: access their own entries</field>
<field name="model_id" ref="model_res_users_settings_volumes"/>
odoo/addons/base/security/base_security.xml
+23
View File
@@ -158,6 +158,29 @@
<field name="domain_force">[('create_uid', '=', user.id)]</field>
</record>
<!-- Record Rule For User settings -->
<record id="res_users_settings_rule_admin" model="ir.rule">
<field name="name">Administrators can access all User Settings.</field>
<field name="model_id" ref="model_res_users_settings"/>
<field name="groups" eval="[Command.link(ref('base.group_system'))]"/>
<field name="domain_force">[(1, '=', 1)]</field>
<field name="perm_read" eval="True"/>
<field name="perm_write" eval="True"/>
<field name="perm_create" eval="True"/>
<field name="perm_unlink" eval="True"/>
</record>
<record id="res_users_settings_rule_user" model="ir.rule">
<field name="name">res.users.settings: access their own entries</field>
<field name="model_id" ref="model_res_users_settings"/>
<field name="groups" eval="[Command.link(ref('base.group_user'))]"/>
<field name="domain_force">[('user_id', '=', user.id)]</field>
<field name="perm_read" eval="True"/>
<field name="perm_write" eval="True"/>
<field name="perm_create" eval="True"/>
<field name="perm_unlink" eval="True"/>
</record>
<!-- rules for API token -->
<record id="api_key_public" model="ir.rule">
<field name="name">Public users can't interact with keys at all</field>