Johan Demaret Rivarola 0d5fcdc1c7 [FIX] base: clear cache before read access check ...

When reading binary content such as `image_128` on `res.users`,
`AccessError` should be raised when necessary.

Steps to reproduce:
  - Populate cache in superuser mode.
  - Access cached field with public user.
  - Read access is allowed but should not.

Concrete example:
  - Unpublish `demo` user.
  - Access `/slides` with `public` user.
  - The template data is generated as `sudo`.
  - The same data is then accessed as `public`.
  - AccessError should be raised when requesting
    `/profile/avatar/<int:user_id>` but is not.

Closes #43826

closes odoo/odoo#45033

X-original-commit: e0112db4d6131751475365ab4c42de848f925dce
Signed-off-by: Christophe Simonis <chs@odoo.com>

2020-02-10 17:43:11 +00:00

..

addons

[FIX] base: clear cache before read access check

2020-02-10 17:43:11 +00:00

cli

[IMP] core: rename upgrades-paths to upgrade-path

2020-02-04 13:19:02 +00:00

conf

…

modules

[FIX] core: delay constraint application in case of upgrade

2020-02-06 18:28:29 +00:00

osv

[FIX] core: search on one2many fields with context

2020-01-21 09:31:58 +00:00

service

[FIX] tests: make --test-file great again

2020-01-14 16:26:50 +00:00

tests

[ADD] sql_db: pre/post-commit/rollback hooks

2020-02-05 13:50:23 +00:00

tools

[FIX] core: delay constraint application in case of upgrade

2020-02-06 18:28:29 +00:00

upgrade

[IMP] core: rename upgrades-paths to upgrade-path

2020-02-04 13:19:02 +00:00

__init__.py

[IMP] core: rename upgrades-paths to upgrade-path

2020-02-04 13:19:02 +00:00

api.py

[IMP] core: improve mapped and filtered performance

2020-01-21 14:06:50 +00:00

exceptions.py

[IMP] core,test_access_rights: improve exept_orm stringification

2019-11-13 11:05:14 +00:00

fields.py

[IMP] doc: some precisions/fixes

2020-02-07 14:00:13 +00:00

http.py

[FIX] *: deprecated access to url_ utilities through werkzeug root

2020-02-04 12:42:35 +00:00

import_xml.rng

[IMP] website_sale, *: keep track of products viewed

2019-09-16 09:38:53 +00:00

loglevels.py

…

models.py

[FIX] base: don't swith back with su=False in _name_search

2020-02-08 18:55:15 +00:00

netsvc.py

[IMP] enable deprecation warnings

2020-02-04 12:42:35 +00:00

release.py

[REL] bump master's alpha version post 13 release

2019-10-17 05:45:33 +00:00

sql_db.py

[ADD] sql_db: pre/post-commit/rollback hooks

2020-02-05 13:50:23 +00:00