Daily updates from Odoo
Friday, January 12, 2024
1 change · 17.0
Resolved issues and error corrections
This fix prevents administrators from editing the employee profile view using the Studio customization tool. When custom fields were added to the profile view, other users would encounter access errors because the new fields weren't included in the system's security whitelist. The solution disables editing of this view to maintain data security and prevent permission conflicts.
Original PR description
Steps to reproduce ================== - Install hr,web_studio - Login with admin - Go to "My Profile" (top right) - Open studio - Add a field - Close studio - Login with demo - Go to "My profile" => There is an access error Cause of the issue ================== On the profile view, there are some fields that are present and the user has read access to using a whitelist SELF_READABLE_FIELDS. If we add another field with studio, it will not be in the whitelist and this will fail the permission check. We cannot simply add a check to whitelist any manual fields, because this could cause some security issues. The res_users.get_view is also read called with sudo when the record is matching the current user. This means groups applied to custom fields from within studio won't restrict the field. Solution ======== Disable the edition of that view. opw-3598600 Forward-Port-Of: odoo/enterprise#53996 Forward-Port-Of: odoo/enterprise#53635