Files
odoo_source/addons/mail/security
Xavier Morel 319f9bf5ea [IMP] mail: allow admins to remove channels they're not members of
The only mail.channel rule was that a user only had access to channels
they're members of, or can subscribe to (public, or group based).

This rule applied to admins as well, forcing them to switch to
super-admin mode in order to manage mail channels.

This is undesirable on lots of axis:

- superadmin mode is a bit of a last-ditch feature, as a result it's
  somewhat hidden
- there is a much higher risk of screwing up as superadmin mode
  basically lifts all the access rules, which can have correctness
  implications
- auditing completely breaks down when using superadmin mode, as the
  real identity of the user is lost

OPW-2857136

closes odoo/odoo#92299

X-original-commit: 1a77ab5726bbcc477d12f40f67433d474ea85316
Signed-off-by: Xavier Morel (xmo) <xmo@odoo.com>
2022-05-30 09:28:49 +02:00
..