Wednesday, February 26, 2025
1 change · saas-17.4
Security fixes and vulnerability patches
Portal users sharing the same company contact no longer automatically gain access to each other's project tasks. This prevents users with limited project access from viewing or editing tasks they are not meant to see.
Original PR description
Steps to reproduce: ------------------- - Install `Project` module - Create a contact as company (e.g. 'Test Company') - Create 2 contacts under the above company (e.g. 'test1' and 'test2') - Grant portal access to these 2 contacts - Create a project and share it with the above 2 portal users - Give 'edit' access to first portal user (test1) - Give 'edit-limited' access to second portal user (test2) - Create a task and add only first user (test1) as follower - Login as second user (test2) and go to Projects (under 'My account') Issue: ------ User 'test2' can see/edit the task, but should not. Cause: ------ By using the `commercial_partner_id` in record rule, we give the rights to all user having the same `commercial_partner_id`. Solution: --------- Instead of `user.partner_id.commercial_partner_id`, use the `user.partner_id` in the record rule. opw-4140453