Why don't window action access rights work?
This is a serious security concern, defining group access rights on menu items is not enough to restrict access to
How do you protect against this ? someone could just try action ids one by one until they find an existing action that gives him/her access to potentially private information.
I restricted access to a window action to a specific group, but I was still able to see it with a user that doesn't belong to that group.
Edit: The same goes for views, when I define access rights, they don't work, I can still access them from other groups.
Is this a bug? or am I missing something?