Comment 4 for bug 944813

Revision history for this message
Valentin Lab (vaab) wrote :

Thanks for the answer. I viewed your video which -- I'm afraid -- doesn't illustrate the bug case as I tried to explain.

What you show in your video is that viewing the form view of a task that is assigned to you will work. (correct me if i'm wrong).

What triggers the bug, is to try to view a task that is assigned to somebody ELSE (let say Bob) which is in the same company as you.
The additional trick, is that Bob must have changed his active company in his profile before you try to view the task.

Here are the steps:
- Making test environnement
    - Create Alice and Bob in the Users
    - Create Microsoft and Apple
    - Alice works at Microsoft, and Bob work at Microsoft AND Apple (he's a lucky guy)
- Test routine:
    - Bob creates a task "Fix that blue screen" while logged in company Microsoft.
    - Bob, then, changes his profile to switch to Apple company.
    - OPTIONAL: For the purpose of the test, he may de-log and let Alice log in.
    - Alice wants to view the Task view form of the task "Fix that blue screen"

Can you repeat it ? Is it clearer ?

As a reminder, also please avoid using "Administrator" as "Alice" role, as ir_rules permissions are not applied to administrator
because:

_compute_domain(...) will have
  ...
  if uid == SUPERUSER_ID:
            return None
  ...

which bypasses any ir_rule permission checks.