Skip ke Konten
Pertanyaan ini telah diberikan tanda
GroupsSecurity
2440 Tampilan
Avatar
SIA, MILWELL HUI

I notice that when you assign a group to a window action,
other users not in the group can still access/execute that window action.

Example:

I have two users:

  • User1 member of Group1
  • User2 not a member of Group1

Now I add Group1 in Security tab of Invoices window action.

When User2 is logged in and clicks Customer->Invoices, he can still open the 
Invoices which expected he should not since the action has "Security" groups already 
assigned.

How do we accomplish this?

Avatar
Buang
Waleed Mohsen (CorTex IT Solutions)

Maybe user2 has a group which inherit group1. is group1 inherited by another group.

SIA, MILWELL HUI
Penulis

I'm sure user2 is not member of group1.
I have done this in testing.
Also looked at the code for ir.actions.act_window
is has the field, groups_id but does not use it.
whereas ir.actions.server
uses the groups_id field in it's run method
starts at line 602 of ir_actions.py

Post Terkait Replies Tampilan Aktivitas
SECURITY: How to stop brute force attack creating > 100 fake orders and trying sql injection?
Security
Avatar
Avatar
1
Apr 25
1904
UPDATED: Make users see only their OWN invoices and bills Diselesaikan
accounting Groups Rules Security
Avatar
Avatar
Avatar
Avatar
Avatar
6
Jul 23
6499
Hide Customers and Vendors menu item
accessrights Accounting Groups Security
Avatar
0
Jun 23
2293
Odoo 13 CE: User becomes invisible after deleted from "Internal Users" group Diselesaikan
Groups
Avatar
Avatar
Avatar
3
Des 20
3622
Need Clarification for "base.user_root" and "base.user_admin" Diselesaikan
xml Security
Avatar
Avatar
2
Sep 24
1783