Friday, March 27, 2020
2 changes · master
Security fixes and vulnerability patches
This update removes duplicate access rules across several Odoo apps and corrects a recruitment permission so only the right managers can edit recruitment stages. This makes permissions easier to understand and reduces the risk of unintended access behavior.
Original PR description
First PR of ACL cleanup, removing duplicate rules, targeting same model/group in same csv file, making one of the two rules useless. [Task ID - 2207847](https://www.odoo.com/web#id=2207847&action=333&active_id=2818&model=project.task&view_type=form&cids=1&menu_id=4720)
Resolved issues and error corrections
This fix stops user groups from being deleted when they are still linked to access rules. It prevents accidental permission changes that could make rules apply too broadly and disrupt what users can see or do.
Original PR description
**Description of the issue/feature this PR addresses:** With a wrong manipulation you can unlink a group. During unlink - the `ir.model.access` is also unlink, - `ir.rule` are not unlink and become global **Current behavior before PR:** Go to runbot. Unlink Portal groups --> all Portal `ir.rule` become global --> there are lot of issue with access (you don't see all records). **Desired behavior after PR is merged:** You cannot unlink a group if it is used. @odony -- I confirm I have signed the CLA and read the PR guidelines at www.odoo.com/submit-pr