İçereği Atla
Bu soru işaretlendi
GroupsSecurity
4132 Görünümler
Avatar
SIA, MILWELL HUI

I notice that when you assign a group to a window action,
other users not in the group can still access/execute that window action.

Example:

I have two users:

  • User1 member of Group1
  • User2 not a member of Group1

Now I add Group1 in Security tab of Invoices window action.

When User2 is logged in and clicks Customer->Invoices, he can still open the 
Invoices which expected he should not since the action has "Security" groups already 
assigned.

How do we accomplish this?

Avatar
Vazgeç
BeyondSys

Maybe user2 has a group which inherit group1. is group1 inherited by another group.

SIA, MILWELL HUI
Üretici

I'm sure user2 is not member of group1.
I have done this in testing.
Also looked at the code for ir.actions.act_window
is has the field, groups_id but does not use it.
whereas ir.actions.server
uses the groups_id field in it's run method
starts at line 602 of ir_actions.py

İlgili Gönderiler Cevaplar Görünümler Aktivite
SECURITY: How to stop brute force attack creating > 100 fake orders and trying sql injection?
Security
Avatar
Avatar
1
Nis 25
3598
UPDATED: Make users see only their OWN invoices and bills Çözüldü
accounting Groups Rules Security
Avatar
Avatar
Avatar
Avatar
Avatar
6
Tem 23
8355
Hide Customers and Vendors menu item
accessrights Accounting Groups Security
Avatar
0
Haz 23
3738
Odoo 13 CE: User becomes invisible after deleted from "Internal Users" group Çözüldü
Groups
Avatar
Avatar
Avatar
3
Ara 20
4833
Need Clarification for "base.user_root" and "base.user_admin" Çözüldü
xml Security
Avatar
Avatar
2
Eyl 24
3893