Odoo Help

Welcome!

This community is for beginners and experts willing to share their Odoo knowledge. It's not a forum to discuss ideas, but a knowledge base of questions and their answers.

0

Block the access through URL

By
Umashankar Subramani
on 5/1/15, 3:57 AM 515 views

Hi ,

    I am facing an issue, that is if i had a user who can view only sales menu , problem is if i tried to paste the url of other menu eg stock.move then it is showing the particular screen, How this can be blocked..... anyone give me a suggestion how to do this........

1
Michael Thomas
On 5/1/15, 4:09 AM

It sounds like he can't see the view, but have you changed his access rights to the stock.move model?

From the odoo documentation: 

Managed by the ir.model.access records, defines access to a whole model.

Each access control has a model to which it grants permissions, the permissions it grants and optionally a group.

Access controls are additive, for a given model a user has access all permissions granted to any of its groups: if the user belongs to group A which allows writing and group B which allows deleting, he can both write and delete.

If no group is specified, the access control applies to all users, otherwise it only applies to the users belonging to the specific group.

Available permissions are creation (perm_create), searching and reading (perm_read), updating existing records (perm_write) and deleting existing records (perm_unlink)

If you restrict the user's access to the stock.move model, for example, they should not be able to load the view without read permissions, even if they enter the URL to load the appropriate action. You can find Access Rights under Settings > Technical > Database Structure > Models > Select your Model > Access Rights. 

Furthermore, don't forget that permissions can be tricky. You need to make sure that every group that the user is a part of doesn't have access to that model. I ran a test to confirm and the user should get an access denied error message when they load the view. 

If you don't see this error and the view shows up check you permissions again. 

I have tested by giving stock.move model in access rights and set the permission to 0,0,0,0 ,but still that user views the stock.move url

Umashankar Subramani
on 5/1/15, 4:13 AM

I double checked. If I have a user that is a "warehouse user" and I remove access rights from the "warehouse user" group, then he loses access to that model. I suspect that whatever user you are trying to block is a member of multiple groups. So, he is able to see that model because one of his other groups has permission. You can try a test by creating a new user but only put him in the warehouse group and restrict rights to that group. Or, you can try removing the user your working with from any of the other groups he is in. Once you have the permissions set right, you should see this error: http://imgur.com/Tc7bz1p.png

Michael Thomas
on 5/1/15, 4:44 AM

Thank you Michael Thomas......I got the issue cleared.....Thanks for your advice......

Umashankar Subramani
on 5/1/15, 5:31 AM

That's partially correct in my opinion, Michael Thomas. If you creates a new employee user, and don't assign any permission else, this user will have read access to search (tree) / form view if you reproduces Umashankar example. And what if you want to create a new group of permissions with certain configuration permissions (e.g.) but you don't want this user to read views of neccesary models? How you avoid the user to load views pasting url on navigator or views load?

Diego Vázquez
on 3/21/16, 4:34 AM

Your Answer

Please try to give a substantial answer. If you wanted to comment on the question or answer, just use the commenting tool. Please remember that you can always revise your answers - no need to answer the same question twice. Also, please don't forget to vote - it really helps to select the best questions and answers!

About This Community

This community is for professionals and enthusiasts of our products and services. Read Guidelines

Question tools

1 follower(s)

Stats

Asked: 5/1/15, 3:57 AM
Seen: 515 times
Last updated: 5/1/15, 5:31 AM