Skip to Content
Dette spørgsmål er blevet anmeldt
GroupsSecurity
4138 Visninger
Avatar
SIA, MILWELL HUI

I notice that when you assign a group to a window action,
other users not in the group can still access/execute that window action.

Example:

I have two users:

  • User1 member of Group1
  • User2 not a member of Group1

Now I add Group1 in Security tab of Invoices window action.

When User2 is logged in and clicks Customer->Invoices, he can still open the 
Invoices which expected he should not since the action has "Security" groups already 
assigned.

How do we accomplish this?

Avatar
Kassér
BeyondSys

Maybe user2 has a group which inherit group1. is group1 inherited by another group.

SIA, MILWELL HUI
Forfatter

I'm sure user2 is not member of group1.
I have done this in testing.
Also looked at the code for ir.actions.act_window
is has the field, groups_id but does not use it.
whereas ir.actions.server
uses the groups_id field in it's run method
starts at line 602 of ir_actions.py

Relaterede indlæg Besvarelser Visninger Aktivitet
SECURITY: How to stop brute force attack creating > 100 fake orders and trying sql injection?
Security
Avatar
Avatar
1
apr. 25
3599
UPDATED: Make users see only their OWN invoices and bills Løst
accounting Groups Rules Security
Avatar
Avatar
Avatar
Avatar
Avatar
6
jul. 23
8358
Hide Customers and Vendors menu item
accessrights Accounting Groups Security
Avatar
0
jun. 23
3742
Odoo 13 CE: User becomes invisible after deleted from "Internal Users" group Løst
Groups
Avatar
Avatar
Avatar
3
dec. 20
4839
Need Clarification for "base.user_root" and "base.user_admin" Løst
xml Security
Avatar
Avatar
2
sep. 24
3896