Friday, September 29, 2023
1 change · master
Security fixes and vulnerability patches
Odoo now applies field-level group permissions when users search or sort records, reducing the chance of restricted information being exposed through queries. The update also keeps portal-related message searches working where needed, avoiding access errors in common customer-facing flows.
Original PR description
#### [IMP] core: check field groups for search domain and order In order to boost the read security of groups on field, we now check groups of field used in search domain and search order. #### [FIX]…
#### [IMP] core: check field groups for search domain and order In order to boost the read security of groups on field, we now check groups of field used in search domain and search order. #### [FIX] mail: allow searching on message_partner_ids for portal Because we now check groups in the domain, some searches raise `AccessError` when using `message_partner_ids` in the domain for the portal user: - https://github.com/odoo/odoo/blob/4d1a1f1c99d6055b60921ce464b72f0f4d9bbfe2/addons/sale/controllers/portal.py#L35 - https://github.com/odoo/odoo/blob/4d1a1f1c99d6055b60921ce464b72f0f4d9bbfe2/addons/sale/controllers/portal.py#L41 - https://github.com/odoo/odoo/blob/ba1a5509fa49fd846739252d16083dd8cb334b53/addons/website_forum/models/forum_post.py#L831 - https://github.com/odoo/odoo/blob/86b43bcfa6c9a5b6ac1b3ac9ba0c308f1169ea3b/addons/hr_timesheet/models/hr_timesheet.py#L41 Since there are many invalid domains and it is impossible to sudo only part of the domain, it is easier to override `_flush_search` to allow `message_partner_ids` in search domain leafs with some restriction. https://github.com/odoo/enterprise/pull/47822