Access Denied on Res Partner on 7.0

Bug #1099071 reported by sadine
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Odoo Server (MOVED TO GITHUB)
New
Undecided
Unassigned

Bug Description

Dear All,

As Administrator, I create a record rule to restrict access to contacts. Bellow the rule definition for object "res.partner":

['|','|',('user_id','=',user.id),('user_id','=',False),('parent_id.user_id','=',user.id)]

Read access only. Then, I attached the "See Own leads" group to this rule.

When I user of this group try to tape any in the "select (search) bar" of the Sales/Clients menu, He got the following error:

Acces denied
The requested operation cannot be completeddue to security restrictions ...
Document type: Partner, Operation: Read)

I tried this in a new & empty database. I create an New user (user2) attached to group "See Own Leads".

We created 2 partners. Test1 and Test2 with user_id as admin and user2.

I logged as User2. From menu "Sales/Clients:
Scenario 1:
- I taped in the search bar the letter "t" which is in Test1 and Test2 partner name) ==>

Acces denied
The requested operation cannot be completeddue to security restrictions ...
Document type: Partner, Operation: Read)

- I taped in the search bar the letter "k" which is not in Test1 and Test2 partner name) ==> no problem!!!

sadine (sidahmed-dine)
description: updated
sadine (sidahmed-dine)
description: updated
description: updated
Revision history for this message
Olivier Dony (Odoo) (odo-openerp) wrote :

Hi,

This looks like a consequence of bug 1094212, so I'm marking it as a duplicate.

PS: please don't check the "Security Vulnerability" option when reporting a bug unless you bug report really describes a possible security vulnerability (typically a bug that can be exploited to gain elevated privileges or execute unauthorized operations).

information type: Private Security → Public
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.