Odoo's Mergebot
f6ed407712
Only system and designer users can access `ir.ui.view` records. An employee, portal or public user should not be able to read a view arch, while ok in standard (all views are in the code anyway), one may want to integrate confidential business logic in some views. All operations on views must be done in `sudo` or use helpers like `fields_view_get` or `_render`. This PR is part of the long-term task id 8203 that plans to remove all access to `ir.*` models **Changes of ACL**: - remove read for all on `ir.ui.view` - remove read for all on `website.page` (uses `_inherits`) - add read on `ir.ui.view` for website publisher (cf `read_template`) (maintain all for system and designer) **Changes of method**: - `fields_view_get` uses `sudo`. Can only be called only if we have the read access on the linked model. - `render*` becomes private `_render*` and uses `sudo`. Shouldn't be able to arbitraly render any template. A QWeb template is not linked to a model so can't apply the same ACL check as in `fields_view_get`. - `read_templates` remains public but without `sudo`. It is called by the method `load` method (now private too) or by the web_editor module **Changes of behaviour** - the `groups_id` parameter may be used on a view to relax the access and allow a specific group to access its content (e.g. frontend assets for employees) closes odoo/odoo#44993 Signed-off-by: Martin Trigaux (mat) <mat@odoo.com>
Odoo
Odoo is a suite of web based open source business apps.
The main Odoo Apps include an Open Source CRM, Website Builder, eCommerce, Warehouse Management, Project Management, Billing & Accounting, Point of Sale, Human Resources, Marketing, Manufacturing, ...
Odoo Apps can be used as stand-alone applications, but they also integrate seamlessly so you get a full-featured Open Source ERP when you install several Apps.
Getting started with Odoo
For a standard installation please follow the Setup instructions from the documentation.
To learn the software, we recommend the Odoo eLearning, or Scale-up, the business game. Developers can start with the developer tutorials