Why don't window action access rights work?

actions

1 ตอบกลับ

11004 มุมมอง

IBS Group

This is a serious security concern, defining group access rights on menu items is not enough to restrict access to actions

How do you protect against this ? someone could just try action ids one by one until they find an existing action that gives him/her access to potentially private information.

I restricted access to a window action to a specific group, but I was still able to see it with a user that doesn't belong to that group.

Edit: The same goes for views, when I define access rights, they don't work, I can still access them from other groups.

Is this a bug? or am I missing something?

Ray Carnes

Using groups to hide or give access to menus is more related to the needs of ergonomics or usability than the needs of security. It is a best practice to putting rules on documents and models instead of putting groups on menus. For example, hiding invoices can be done by modifying the record rule on the invoice object, and it is more efficient and safer than hiding menus related to invoices.

Similarly, using groups to hide or give access to views based on groups should also not be considered as meeting security needs.

From "Security in OpenERP: users, groups" at https://doc.openerp.com/trunk/server/04_security/

IBS Group

ผู้เขียน

Thank your your answer, however your last suggestion does not work, I tested it but I could still access restricted views, the same goes for actions, which is the main thing I am asking about.

Ray Carnes

My suggestion was not to use groups for Views or Actions to meet your security needs.

IBS Group

ผู้เขียน

Assign a group to some window action and try to access it directly through action=ID in the URL from a user that don't belong to that group and you should be able to execute that action and see its results.

สนุกกับการพูดคุยนี้ใช่ไหม? เข้าร่วมเลย!

สร้างบัญชีวันนี้เพื่อเพลิดเพลินไปกับฟีเจอร์พิเศษและมีส่วนร่วมกับคอมมูนิตี้ที่ยอดเยี่ยมของเรา!

ลงชื่อ

Related Posts	ตอบกลับ	มุมมอง
My ir.actions.server isn't being triggered on sales order save, why? actions	1 มี.ค. 15	7157
Why don't window action access rights work? actions	0 มี.ค. 15	5592
Why don't window action access rights work? actions	0 มี.ค. 15	6018
Prevent Users to Devliver more than demanded quantity. แก้ไขแล้ว actions stock.move	3 เม.ย. 26	4046
Server action triggering Server action (Odoo 12) actions server_actions	0 มี.ค. 25	2512

คำถามนี้ถูกตั้งค่าสถานะ

สนุกกับการพูดคุยนี้ใช่ไหม? เข้าร่วมเลย!