JFTR:
Related links in Debian:
http://lists.debian.org/debian-security-announce/2012/msg00072.html
http://security-tracker.debian.org/tracker/CVE-2012-0215
and later:
http://www.debian.org/security/2012/dsa-2444

Fixed with changeset 8e64d52ecea4

I have written a small script to test if vulnerability is fixed.
It just add a group to the current user using XML-RPC calls.

> I don't understand why commit message should have this number in more of the
link to this issue.

A CVE number is cross identifier. Is is the purpose of this number to help
identifying all procedures/messages/issues related to this subject.

On 24/03/12 13:03 +0100, Mathias Behrle wrote:
> 
> Mathias Behrle <mathias.behrle@gmx.de> added the comment:
> 
> >From our (the Debian) side we are prepared to do the uploads.
> 
> I propose Mo, 26.03 as release date. Is this ok for you?

No, I'm not available to do it before 28/03

I don't understand why commit message should have this number in more of the
link to this issue.

From our (the Debian) side we are prepared to do the uploads.

I propose Mo, 26.03 as release date. Is this ok for you?

CVE-2012-0215 was assigned by the Debian project to this issue.

The according ticket is:
The Tryton project discovered a vulnerability caused by missing checks of 
access permissions on certain models in the Tryton server. The fix consists of
disabling 'create', 'write', 'delete' and 'copy' actions via rpc for those
models.

Please include the CVE number in all commit messages and news related to the
subject.

FYI: Forwarded to team@security.debian.org (fixed version 1.6.1-2+squeeze1).
Will be uploaded together with unstable immediately after the release.

CVE requested.

> Would you like to get a CVE number? AFAIK the security team could assign one.

Why not, I don't know exactly how it works.

Here are all the reviews:
2.2: review307001
2.0: review307002
1.8: review304002
1.6: review308001
1.4: review309001

Could you please push also the fix for version 1.6 to codereview. This is the
version in Debian stable and only this fix will be accepted, not an update to
current 1.6.x.
With this fix I would like to coordinate with the security team to have approval
for simultaneous uploads to stable and unstable.
Would you like to get a CVE number? AFAIK the security team could assign one.

If everybody agree on the fix, I propose this way of working:

- Push the fix in trunk and all supported series in one time
- Make a release for every series (preferably the same day)
- Publish a security news that explains the issue.

Add security roles to nosy list.

Please test the review303001

Relation models for Many2Many doesn't have ir.model.access record as they are
just ModelSQL but not ModelView.
So I think we must remove create, read, write and delete from _rpc.