-
- Downloads
[FIX] mail: Reserve mis-referenced trackings to system users
Purpose ======= Let's say that the field 'foo' is tracked and defined with a res.group. When the field is modified, a mail.tracking.value is generated, but the reference to the field name is a char field. When displaying the mail.tracking.values on the chatter, a check is done according to the field group to decide whether we should display it or not to the user. See: odoo/odoo@c7aa8c5#diff-ad8b6db158187579d2208f233d993c3cR43 So if I rename the field, and if the mail.tracking.value is not modified, the mail.tracking.value magically appears to the users who shouldn't access it before. Note: If the migration is correctly handled, this shouldn't be the case. But manual manipulations on the database could lead to this issue. Specification ============= If the field referenced by the mail_tracking_value doesn't seem to exist, then display its value to system users only, by security. closes odoo/odoo#39033 Taskid: 2088634 X-original-commit: ae1e70eb Signed-off-by:Yannick Tivisse (yti) <yti@odoo.com>
Please register or sign in to comment