Odoo Server (MOVED TO GITHUB)

Access rules on fields.related in osv.TransientModel

Asked by Yann Papouin

I don't know if it's a bug or not but:

If you add a fields.related (to a Model like stock.move) in a transient model (like stock.partial.picking.line) that will be displayed in a wizard, all access rules on these fields are bypass by the uid automatically changed to SUPERUSER (==1) in _fnct_read from fields.py.

It is a normal behavior ?

Question information

Language:
English Edit question
Status:
Open
For:
Odoo Server (MOVED TO GITHUB) Edit question
Assignee:
No assignee Edit question
Last query:
Last reply:

This question was originally filed as bug #1123018.

Revision history for this message
Naresh(OpenERP) (nch-openerp) said : 		#1

Hi Yann,

No, this is not a bug, its done intentionally to behave like this. we allow the user to read the value even if it comes from a model to which they have no access. the idea of related fields is to delegate the storage of the content to another object, so it seems logical to act exactly as if it was a field owned by the current model

Thanks,
Naresh Soni,
Team Lead,
OpenERP Enterprise Services

Can you help with this problem?

Provide an answer of your own, or ask Yann Papouin for more information if necessary.

To post a message you must log in.