odoo/odoo#257517
Created by fw-bot
Statuses:
- legal/cla: Contributor License Agreement check
- ci/runbot: Odoo Test Suite
- ci/upgrade_enterprise: Test upgrades for enterprise master
- ci/template: (runtime 2142s)
- ci/style: Optional style check. Ignore it only if strictly necessary.
- ci/security: Required security check. Can only be ignored by security team.
- label
- odoo-dev:18.0-17.0-web-read-x2many-filter-cache-records-cro-502639-fw
- head
- 05ded3eda89fb8ff9aafa62f314a9d5d4677d292
- merged
- 4 months ago by Framework (ORM), Krzysztof Magusiak (krma)
| odoo/odoo | |
|---|---|
| 17.0 | #250904 |
| 18.0 | #257517 |
| saas-18.2 | #259184 |
| saas-18.3 | #259185 |
| saas-18.4 | #259186 |
| 19.0 | #259188 |
| saas-19.1 | #259189 |
| saas-19.2 | #259190 |
[FIX] web: filter cached inaccessible x2many records in web_read
Description of the issue/feature this PR addresses:
web_read on x2many fields can reuse cached ids after write/web_save. Some of these cached ids may be inaccessible with the current record rules/context (cache pollution).
Example:
- Context:
- Two companies exist: Company A and Company B.
- Two users exist: User A and User B.
- User A can only access Company A (company_ids=[A], company_id=A).
- User B is linked to both companies (company_ids=[A, B], company_id=A).
- The "res.company" record rule is the standard one: [('id', 'in', company_ids)] (company_ids comes from allowed_company_ids).
- User A edits User B and saves the form.
- Steps:
- User A performs a web_read to load User B: company_ids contains only Company A.
- User A performs web_save (write + internal web_read in the same request): cached ids [A, B] are reused and the code attempts to read Company B.
Current behavior before PR (without fix):
After saving a form with an x2many field, web_save calls write and then web_read. In this flow, web_read can include inaccessible x2many ids from cache and raise an AccessError.
Desired behavior after PR is merged:
x2many records are re-filtered with current read rules before formatting, and inaccessible ids are removed from values_list.
Forward-Port-Of: #250904