Community mailing list archives

Security of Many2Many fields

Jerome Sonnet
- 10/29/2016 04:14:53
Hi Community,

I have a classic Many2Many model

ModelA --- A_B_rel --- ModelB

and I would like some users to be able to create ModelA instances and to link them to ModelB while not having the righ to create/delete ModelB instances.

Here are my findings :

Using the standard tree widget, a user that only have access right to ModelB cannot add/remove items from the tree, i.e. there is no Add an item, nor trash icon.

A weird thing is that if I replace the standard Tree widget with the many2many_tags one, the user can add/remove ModelB without any problem, it is to my understanding then not a security problem but more the way the tree widget interpret the security.

Have anyone encounter that behavior ? Any work around/solution ?

Many thanks,