users share field group access incorrect

[Hannes (Neobis)]

In the module 'share', in the file 'res_users.py' :

In both 'share' field definitions (res.groups and res.users) is the attribute:
    groups='share.group_share'

However, this group is not declared anywhere in the 'share' module. I can see the ID 'group_share_user' in the security file. I think this should be used in the 'share' fields.

I found this bug in the addons of OpenERP:
branch: http://bazaar.launchpad.net/~openerp/openobject-addons/6.0/
revno: 4821
(i did not search for other branches, revisions or whatever).

I found this bug because I wanted to learn how the 'groups' attribute on 'fields' works. There is little documentation about this. Might it be deprecated???

[Hannes (Neobis) (nb2)]

Exact location:

http://bazaar.launchpad.net/~openerp/openobject-addons/6.0/view/head:/share/res_users.py#L27
http://bazaar.launchpad.net/~openerp/openobject-addons/6.0/view/head:/share/res_users.py#L36

[Olivier Dony (Odoo) (odo-openerp)]

Hi,

To answer your question, the `groups` attribute that you can put on fields will restrict its visibility (in the UI) to only members of the named groups. It's not deprecated, and may be a comma-separated list of groups, in which case it will be visible to users of all the mentioned groups.
This is by no means a security mechanism (hence this is not a security bug), it's only present to customize views, and will not enforce any per-field access restriction. You can use it in the python declaration to make it global, or put it in any view, for local effect.

Now you're right, the correct ID of the group is 'share.group_share_user'. However this is of no consequence here, because the 'share' field is not displayed in users/groups form/list views at all, it's an internal flag to track 'share users'.
And it's simply not included in any form/list view, so that's fine. It should only be in the search view, along with the special 'no_share' filter used to hide 'share_users' by default, and visible by everyone.

The unnecessary and incorrect `groups` attributes should still be removed, as they're just confusing. This was done in trunk at revision 5239 revid: <email address hidden>

Thanks for reporting!

[Hannes (Neobis) (nb2)]

Thanks Olivier!

1 question left, if I may...
I'm working on the official training material of OpenERP and there is a (hidden) part about per-field access restrictions. I'm wondering if this will be included anytime soon, since this link (https://bugs.launchpad.net/openobject-client/+bug/854849/comments/1) tells me there is no way to do this currently.

A data record in XML for ir_model_fields_group_rel is the only way I can think of. But I suppose this is not yet training material.

Thanks again!

[Olivier Dony (Odoo) (odo-openerp)]

On 09/30/2011 11:13 AM, NEOBIS2 wrote:
> I'm wondering if this will be included anytime soon, since this link
> (https://bugs.launchpad.net/openobject-client/+bug/854849/comments/1)

It's not in the roadmap as far as I know, but it's possible that invitu
(poster of bug 854849) will contribute or sponsor something along those
lines eventually.

> But I suppose this is not yet training material.

Indeed, per-field access control is not supported at the moment, so
there is nothing to teach about it, except that it's not supported ;-)