Skip to content
Snippets Groups Projects
Commit 7b8038c4 authored by Kevin Baptiste's avatar Kevin Baptiste Committed by fw-bot
Browse files

[FIX] mail: Reserve mis-referenced trackings to system users


Purpose
=======

Let's say that the field 'foo' is tracked and defined with a res.group.

When the field is modified, a mail.tracking.value is generated, but the
reference to the field name is a char field.

When displaying the mail.tracking.values on the chatter, a check is done
according to the field group to decide whether we should display it or not
to the user. See: odoo/odoo@c7aa8c5#diff-ad8b6db158187579d2208f233d993c3cR43

So if I rename the field, and if the mail.tracking.value is not modified,
the mail.tracking.value magically appears to the users who shouldn't
access it before.

Note: If the migration is correctly handled, this shouldn't be the case.
But manual manipulations on the database could lead to this issue.

Specification
=============

If the field referenced by the mail_tracking_value doesn't seem to exist,
then display its value to system users only, by security.

closes odoo/odoo#39033

Taskid: 2088634
X-original-commit: ae1e70eb
Signed-off-by: default avatarYannick Tivisse (yti) <yti@odoo.com>
parent bf99c212
No related branches found
No related tags found
No related merge requests found
......@@ -40,7 +40,7 @@ class MailTracking(models.Model):
for tracking in self:
model = self.env[tracking.mail_message_id.model]
field = model._fields.get(tracking.field)
tracking.field_groups = field.groups
tracking.field_groups = field.groups if field else 'base.group_system'
@api.model
def create_tracking_values(self, initial_value, new_value, col_name, col_info, tracking_sequence):
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment