Odoo Changelog — 2020-02-05

Wednesday, February 5, 2020

2 changes

Security(2)

Security fixes and vulnerability patches

[MERGE] base: use ir.model.access on TransientModels

Coremasterbaseaccountaccount_check_printingbase_gengobase_importbase_import_modulebase_sparse_fieldcrmdeliveryevent_salegamificationgoogle_accountSECURITY

This change makes temporary wizard screens follow the same access control checks as regular business records. It reduces the risk that users can misuse setup or processing wizards by entering chosen values outside their intended permissions, while also hiding actions that users cannot use.

Original PR description

Before this commit, models with the `_transient` flag were ignored in
ir.model.access verifications. Only an implicit ir.rule with the
domain (create_uid=user.id) was applied to avoid most side effects.

The problem is that, often, the security does not lie in side-effects
of abusing of somebody else's wizard record but in the fact that the
wizard methods blindly trust only the right users are creating these
records. Too often, too many sudo were used and creating wizard with
chosen values could lead to an abuse scenario.

Instead, explicitly require the developer to declare security rules
the same way as on any other model.

Task-id: 1863044
Pad: https://pad.odoo.com/p/r.c1befa51103ed3b955a427971eb19719

#access-control#permissions#wizards#security

[ADD] *: add ir.model.access on all transient models

PR #7737

Enterprisemasteraccount_accountantaccount_assetaccount_bank_statement_importaccount_batch_paymentaccount_online_syncaccount_reportsaccount_winbooks_importcrm_helpdeskdelivery_easypostdocumentshelpdesk_fsmhelpdesk_sale_couponhr_appraisalhr_contract_salaryhr_contract_signhr_payrollhr_payroll_account_sepahr_referralindustry_stock_fsmiotl10n_be_hr_payrolll10n_be_reportsmarketing_automationmrp_mpsmrp_workorderplanningsale_ebaysale_rentingsale_renting_signsale_subscriptionsignstock_barcodevoipSECURITY

This update adds missing permission rules for many temporary workflows, such as creating tickets, requesting signatures, generating payroll or contract links, importing statements, and managing stock or delivery actions. It helps ensure employees and managers can perform the right actions while keeping restricted operations limited to the appropriate roles.

Original PR description

Follow up of odoo/odoo#43306

#permissions#access control#security#workflows

Before this commit, models with the `_transient` flag were ignored in ir.model.access verifications. Only an implicit ir.rule with the domain (create_uid=user.id) was applied to avoid most side effects. The problem is that, often, the security does not lie in side-effects of abusing of somebody else's wizard record but in the fact that the wizard methods blindly trust only the right users are creating these records. Too often, too many sudo were used and creating wizard with chosen values could lead to an abuse scenario. Instead, explicitly require the developer to declare security rules the same way as on any other model. Task-id: 1863044 Pad: https://pad.odoo.com/p/r.c1befa51103ed3b955a427971eb19719