Daily updates from Odoo
Wednesday, November 27, 2024
1 change · master
Security fixes and vulnerability patches
Appointment-related access checks were reorganized so each record type can manage its own rules. This reduces the chance that shared access logic could accidentally expose sensitive information while keeping normal permitted access efficient.
Original PR description
This commit cleans up the code related to `_find_record_check_access` method: - By moving `_find_record_check_access` from `ir.binary` into the models, each model can add its own behavior without affecting others. This change reduces the risk of exposing sensitive data through many overrides of `_find_record_check_access`. - `_can_elevate_access` method is now responsible for checking if it's possible to bypass the ACLs, but this method only applies when there is no standard access read to the record. If a record is allowed to be read by ACLs, we don't want to do an extra check. Related to odoo/odoo#186003