openerp-community team mailing list archive

[Alexis de Lattre <alexis@xxxxxxxxxx>]

Dear OpenERP community friends,

I share with you something that may be interesting for the whole 
community. The issue I point out is present in OpenERP 6.0 and 6.1 
(probably in other versions too) :

1. Only few groups have write access on res.partner.address : Partner 
Manager, Administration / Configuration, HR Manager and Accounting & 
Finance / Invoicing & Payments (in v6.1)

2. It means that, if you want your sales, purchase or stock users (not 
managers) to be able to update a phone number or an email address on a 
Partner Address, you will probably think : he needs write access on 
Partner Addresses, so I need to add him to the group "Partner Manager".

3. If you look at the details of the ACLs for the group "Partner 
Manager", you will see that this group has write/create access on 
res.partner.bank and res.bank.

4. It means that all users that belong to the "Partner Manager" group 
can modify the bank account numbers and other bank details on any partner.

5. Imagine one of them replaces the IBAN and BIC of a supplier by his 
own bank account.

6. If the company uses OpenERP to generate bank files to pay the 
suppliers, the employee will receive the money instead of the supplier !

7. The employee then runs away to the British Virgin Islands... :)

Of course, I know that all OpenERP integrators take the time to review 
all ACLs on every deployment of OpenERP to check that nobody has "too 
much" rights... :-)

But I wanted to share the light on this issue... the "Partner Manager" 
group gives a lot of rights, probably too much for a regular employee... 
but you probably want your regular employees to update phone numbers and 
e-mail addresses on partners, but there is no native "intermediate" 
group to give them such rights.

Regards,

--
Alexis de Lattre