David Beguin 859537d77c [FIX] mail: Reserve mis-referenced trackings to system users ...

Note : Manual forward port recovering from commit ae1e70eba10112170283cfc17fa95d94dd948d2b

Purpose
=======

Let's say that the field 'foo' is tracked and defined with a res.group.

When the field is modified, a mail.tracking.value is generated, but the
reference to the field name is a char field.

When displaying the mail.tracking.values on the chatter, a check is done
according to the field group to decide whether we should display it or not
to the user. See: c7aa8c5#diff-ad8b6db158187579d2208f233d993c3cR43

So if I rename the field, and if the mail.tracking.value is not modified,
the mail.tracking.value magically appears to the users who shouldn't
access it before.

Note: If the migration is correctly handled, this shouldn't be the case.
But manual manipulations on the database could lead to this issue.

Specification
=============

If the field referenced by the mail_tracking_value doesn't seem to exist,
then display its value to system users only, by security.

closes #39016

closes odoo/odoo#52348

Taskid: 2088634
X-original-commit: 19bc081e4a71042c3f009e4af641da18fc16bdfe
Signed-off-by: Yannick Tivisse (yti) <yti@odoo.com>
Signed-off-by: Thibault Delavallee (tde) <tde@openerp.com>

2020-06-03 11:55:08 +00:00

..

__init__.py

[REF] ir.autovacuum: declarative garbage collector registration

2020-05-19 13:38:19 +00:00

ir_action_act_window.py

[FIX] *: set ondelete policy of required Selection fields

2020-03-30 13:42:04 +00:00

ir_actions.py

[FIX] mail: variable not referenced before assignment

2020-05-07 08:14:16 +00:00

ir_attachment.py

[FIX] mail: don't raise access error on register_as_main_attachment

2020-02-14 10:15:12 +00:00

ir_config_parameter.py

[FIX] mail: do not prevent user from re-entering the same alias value

2020-04-27 15:32:38 +00:00

ir_http.py

[IMP] mail, test_mail, hr_holidays: remove obsolete out of office

2020-02-10 13:05:04 +00:00

ir_model_fields.py

[IMP] core: reflect models, fields and selections in batch

2020-04-03 11:40:29 +00:00

ir_model.py

[IMP] fields: add validation of parameter names

2020-04-07 09:25:08 +00:00

ir_ui_view.py

…

mail_activity.py

[IMP]mail:set a default value for field Activity Type when scheduling activity

2020-05-22 07:07:25 +00:00

mail_alias_mixin.py

[REF] mail: make alias mixin multi-enabled

2020-04-17 06:52:09 +00:00

mail_alias.py

[IMP] *: convert to private methods

2020-05-14 13:59:10 +02:00

mail_blacklist.py

[MOV] mail: move blacklist mixin in its own file and rename thread_cc file

2020-05-12 12:00:01 +00:00

mail_channel.py

[IMP] mail_bot: improve OdooBot workflow

2020-05-27 12:47:16 +00:00

mail_followers.py

[FIX] mail: make followers computation compatible with postgresql < 10

2020-02-25 13:24:23 +00:00

mail_mail.py

[IMP] mail, sms, snailmail, test_mail_full: adapt mail.notification

2020-04-17 12:17:57 +00:00

mail_message_subtype.py

…

mail_message.py

[IMP] *: convert to private methods

2020-05-14 13:59:10 +02:00

mail_notification.py

[LNT] mail: lint and reorder mail_notification files

2020-04-22 08:40:04 +00:00

mail_render_mixin.py

[FIX] *: useless parameter 'placeholder' on fields

2020-04-07 09:25:08 +00:00

mail_shortcode.py

…

mail_template.py

[IMP] *: convert to private methods

2020-05-14 13:59:10 +02:00

mail_thread_blacklist.py

[MOV] mail: move blacklist mixin in its own file and rename thread_cc file

2020-05-12 12:00:01 +00:00

mail_thread_cc.py

[MOV] mail: move blacklist mixin in its own file and rename thread_cc file

2020-05-12 12:00:01 +00:00

mail_thread.py

[FIX] mail: fix tracked field with groups

2020-05-27 05:53:13 +00:00

mail_tracking_value.py

[FIX] mail: Reserve mis-referenced trackings to system users

2020-06-03 11:55:08 +00:00

models.py

…

res_company.py

…

res_config_settings.py

…

res_partner.py

[IMP] mail: track the email and the phone of the partner

2020-05-18 15:03:29 +00:00

res_users.py

[IMP] *: create users and partners in batch

2020-04-27 12:00:45 +02:00

update.py

…