Damien Bouvy
d2b02cab29
The `session_info` dictionnary is used to bootstrap some JS code client side (usually in the backend). It includes relevant information, such as some parameters key for the OdooBot onboarding, the Enterprise subscription expiration alert, etc. to avoid triggering a lot of RPC calls upon webclient start. `session_info` is also called by the remote authentication mechanism located at `/web/session/authenticate`, which can be used by external mechanism to obtain a valid session remotely. Revision odoo/odoo@8a28cc2 introduced the concept of cache keys for some oft-requested data (such as menus, translations and dynamic qweb templates) to avoid requesting them on each webclient start, since they tend not to change often. Unfortunately, it introduced a read on the ir.ui.menu model that raised an `AccessError` if the authenticating user was not a member of the `base.group_user` group ('Internal' user type). While fixing that issue, it became apparent that `session_info` returns a whole lot of information through this remote connection route which is entirely unnecessary if not used in the context of a webclient start, such a currencies, the state of the enterprise subscription, etc. This commit fixes the access right issue by removing this non-relevant information from the returned dict (including cache keys) if the user is not an internal one. closes odoo/odoo#40770 X-original-commit: 6e99ac2c6cd5ca9af87b4fc7a3a1394359e30b02 Related: odoo/enterprise#6860 Signed-off-by: Damien Bouvy (dbo) <dbo@odoo.com>
Odoo Enterprise Social Network
Connect with experts, follow what interests you, share documents and promote best practices with Odoo Enterprise Social Network. Get work done with effective collaboration across departments, geographies, documents and business applications. All of this while decreasing email overload.
Connect with experts
Next time you have a question for the marketing, sales, R&D or any other department, don't send an email blast-post the question to Odoo and get answers from the right persons.
Follow what interests you
Want to get informed about new product features, hot deals, bottlenecks in projects or any other event? Just follow what interests you to get the information you need what you need; no more, no less.
Get Things Done
You can process (not only read) the inbox and easily mark messages for future actions. Start feeling the pleasure of having an empty inbox every day; no more overload of information.
Promote best practices
Cut back on meetings and email chains by working together in groups of interests. Create a group to let people share files, discuss ideas, and vote to promote best practices.
Improve Access to Information and Expertise
Break down information silos. Search across your existing systems to find the answers and expertise you need to complete projects quickly.
Collaborate securely
Set the right security policy; public, private or on invitation only -- according to the information sensitivity.
A Twitter-like Network For My Company
Make every employee feel more connected and engaged with twitter-like features for your own company. Follow people, share best practices, 'like' top ideas, etc.