openerp-india team mailing list archive

["Daniel Reis \(SECURITAS SA\)" <1070884@xxxxxxxxxxxxxxxxxx>]

Hi Stefan,

No standard module uses this method.  I think this kind of use case is not addressed in any standard module.
Using attrs in views is necessary when using both methods.( It's a workaround for, IMHO, a missing feature in OpenERP). 

But they don't replace the state-based ir_rules that add a more robust security layer and prevent unintended changes through direct access to the ORM (using an XML-RPC call for instance).
AFAIK there is no other way to enforce that.

Focusing on the problem described in the bug report, maybe the intended
behaviour can be achieved customizing the create()/write() methods.

-- 
You received this bug notification because you are a member of OpenERP
Indian Team, which is subscribed to OpenERP Server.
https://bugs.launchpad.net/bugs/1070884

Title:
  ir_rule should apply to the result of a Model.write()

Status in OpenERP Server:
  Fix Committed
Status in Therp Backports:
  Fix Committed

Bug description:
  Currently in OpenERP 6.1 and trunk the record rules are applied at
  write time only before the resource is written. This is inconsistent
  with creating resources, as in that case the record rules are applied
  at the results.

  For instance, we have applied a record rule that restricts HR officers
  from writing their own record (or their contracts). Under the current
  behaviour, they can still create a new employee with their own user
  associated with it (but they cannot delete it).

  I think that the rule should apply to the resources before
  modification as well as after the modification.

To manage notifications about this bug go to:
https://bugs.launchpad.net/openobject-server/+bug/1070884/+subscriptions