Community mailing list archives
Security of Many2Many fieldsby
I have a classic Many2Many model
ModelA --- A_B_rel --- ModelB
and I would like some users to be able to create ModelA instances and to link them to ModelB while not having the righ to create/delete ModelB instances.
Here are my findings :
Using the standard tree widget, a user that only have access right to ModelB cannot add/remove items from the tree, i.e. there is no Add an item, nor trash icon.
A weird thing is that if I replace the standard Tree widget with the many2many_tags one, the user can add/remove ModelB without any problem, it is to my understanding then not a security problem but more the way the tree widget interpret the security.
Have anyone encounter that behavior ? Any work around/solution ?