Wednesday, January 10, 2024
2 changes · master
Code cleanup and technical improvements
This change removes an internal duplicate access-checking mechanism and relies on more consistent permission checks instead. It helps keep user and project task data protected while reducing complexity and avoiding accidental access errors in project task handling.
Original PR description
_read_group_check_field_access_rights() is a superfluous hook of the _read_group() refactor (https://github.com/odoo/odoo/pull/110737). But this hook isn't very useful compared to check_field_access_rights(), it only checks the usage of fields used in _read_group(). - For 'res.users': Check the security in _read_group_select() and _read_group_groupby() instead. We cannot forbid USER_PRIVATE_CHECK in check_field_access_rights() because we want to obfuscate this field, and not throw an AccessError when reading it. - For 'project.task': override check_field_access_rights() to cover all cases and override _determine_fields_to_fetch() to avoid reading an inaccessible field and having an accidental AccessError. https://github.com/odoo/enterprise/pull/53409
This change updates HR Referral and HR Appraisal to use the newer standard way of checking access to sensitive fields. It keeps field-level protections aligned with the main Odoo platform while simplifying the referral logic and preserving record-specific security for appraisals.
Original PR description
…_rights() Since _read_group_check_field_access_rights() is removed in the community version, then remove the remaining occurrences of it. - For hr.referral: Simplify each check by overriding only check_field_access_rights(). - For hr.appraisal: We actually want security checks on fields depending on the record itself. Then change the paradigm with 2 new compute/inverse fields that manage the security during the read and the write. https://github.com/odoo/odoo/pull/146438