Skip to content
Snippets Groups Projects
Commit 859537d7 authored by David Beguin's avatar David Beguin
Browse files

[FIX] mail: Reserve mis-referenced trackings to system users


Note : Manual forward port recovering from commit ae1e70eb

Purpose
=======

Let's say that the field 'foo' is tracked and defined with a res.group.

When the field is modified, a mail.tracking.value is generated, but the
reference to the field name is a char field.

When displaying the mail.tracking.values on the chatter, a check is done
according to the field group to decide whether we should display it or not
to the user. See: c7aa8c5f#diff-ad8b6db158187579d2208f233d993c3cR43

So if I rename the field, and if the mail.tracking.value is not modified,
the mail.tracking.value magically appears to the users who shouldn't
access it before.

Note: If the migration is correctly handled, this shouldn't be the case.
But manual manipulations on the database could lead to this issue.

Specification
=============

If the field referenced by the mail_tracking_value doesn't seem to exist,
then display its value to system users only, by security.

closes #39016

closes odoo/odoo#52348

Taskid: 2088634
X-original-commit: 19bc081e4a71042c3f009e4af641da18fc16bdfe
Signed-off-by: default avatarYannick Tivisse (yti) <yti@odoo.com>
Signed-off-by: default avatarThibault Delavallee (tde) <tde@openerp.com>
parent 8a48aee8
No related branches found
No related tags found
No related merge requests found
......@@ -39,7 +39,7 @@ class MailTracking(models.Model):
for tracking in self:
model = self.env[tracking.mail_message_id.model]
field = model._fields.get(tracking.field.name)
tracking.field_groups = field.groups
tracking.field_groups = field.groups if field else 'base.group_system'
@api.model
def create_tracking_values(self, initial_value, new_value, col_name, col_info, tracking_sequence, model_name):
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment