Denis Ledoux ec0cd75328 [IMP] core: disable x2many manipulation as sudo for sensitive models ...

This revision adds a flag
`_allow_sudo_commands` to which models can opt-in
to protect themselves against malicious
manipulation of one2many or many2many fields
through an environment using `sudo` or a more priviledged user.

Flagging a model `_allow_sudo_commands = False`
disable `sudo` and `with_user(...)`
when manipulating a one2many or many2many
field targeting this model.

task-3695103

2023-11-01 08:05:16 +00:00

..

addons

[IMP] core: disable x2many manipulation as sudo for sensitive models

2023-11-01 08:05:16 +00:00

cli

[IMP] *: use correct indentation in manifest summary

2023-10-11 08:18:49 +00:00

conf

…

modules

[FIX] core: KeyError odoo.fields in compute_value

2023-12-15 21:02:10 +00:00

osv

[FIX] base: raise ValueError when user enters wrong path

2023-11-08 12:14:50 +00:00

service

[FIX] core: avoid 'Registry' object has no attribute '_m2m' error

2023-12-15 21:02:10 +00:00

tests

[FIX] core: avoid hiding access error in onchange() with Form

2024-01-11 17:00:50 +00:00

tools

[FIX] core: fix import error after translate override

2024-01-10 06:12:25 +00:00

upgrade

…

__init__.py

[IMP] core, requirements: bump minimal python version to 3.10

2023-10-06 21:11:52 +00:00

__main__.py

…

api.py

[IMP] core: disable x2many manipulation as sudo for sensitive models

2023-11-01 08:05:16 +00:00

exceptions.py

…

fields.py

[IMP] core: disable x2many manipulation as sudo for sensitive models

2023-11-01 08:05:16 +00:00

http.py

[FIX] core: HTTP 413 when restoring large backups

2024-01-04 12:01:59 +00:00

import_xml.rng

[IMP] convert: autofill sequence fields

2023-10-06 13:08:51 +00:00

loglevels.py

…

models.py

[IMP] core: disable x2many manipulation as sudo for sensitive models

2023-11-01 08:05:16 +00:00

netsvc.py

…

release.py

[REL] 17.0

2023-10-26 19:39:28 +00:00

sql_db.py

[FIX] *: restore gettext and unlink lints

2023-10-26 13:41:19 +00:00