Record rules not enforced when reading only fields without SQL type

As @edbo pointed on this message, when reading only field without SQL type (like Function fields), the access rules are not enforced.

added trytond type::behavior labels

assigned to @ced

mentioned in commit aa72a36215c2

mentioned in merge request !670 (merged)

All supported series are affected.

I plan to make a security release on July 31st 2023 with this CVSS v3.0 Base Score: 6.5

changed due date to July 31, 2023

mentioned in commit f4a0c47649bb

I don't fully understand the message. We are not talking about a Function field, but about a Many2One field. A user X has added a record in the Many2One which user Y does not have access to. The current situation is that the rec_name of that record is shown to user Y, but user Y cannot open the record details because an UserError shows up. I think this is correct.

For example, you have a record rule on products. User X creates a new sale order and add sale lines to it. One sale line has a product which access is enforced with the record rule. Now user Y opens that sale order and can see the product rec_name on the sale line, but user Y cannot open the product record to see the details.

I don't fully understand the message. We are not talking about a Function field, but about a Many2One field. A user X has added a record in the Many2One which user Y does not have access to. The current situation is that the rec_name of that record is show to user Y, but user Y cannot open the record details because an UserError shows up. I think this is correct.

No this is not. If you do not have read access to a record, you can not read any of its fields.

For example, you have a record rule on products. User X creates a new sale order and add sale lines to it. One sale line has a product which access is enforced with the record rule. Now user Y opens that sale order and can see the product rec_name on the sale line, but user Y cannot open the product record to see the details.

Well this is a partial setup of record rules.

...

On 2023-07-24 09:37, edbo (@edbo) wrote:

-- Cédric Krier - B2CK SPRL Email/Jabber: cedric.krier@b2ck.com Tel: +32 472 54 46 59 Website: https://www.b2ck.com/

mentioned in commit bd69f1025bca

closed with merge request !670 (merged)

mentioned in commit 24b09f41bc0c

mentioned in commit 5feb3b4e90e2

mentioned in commit 82c58a4ada12

mentioned in commit 9c87389ffa03

mentioned in commit 71e83d2455fd

made the issue visible to everyone