Guessing order on field without access
Similar to #7766 (closed), it is possible to retrieve the order of a field for which user has no read access.
E.g.: Employee.search([], order=[('cost_price', 'ASC')])
By reading [1], it shows that it is possible to guess the values if the data has a normal distribution and if we know the maximal range. Even if we are not in the exact same situation as described. Knowing the order of such field may leak too much data.
So I propose to use the same solution as for #7766 (closed) and check read access on the field used in order.
[1] https://blog.cryptographyengineering.com/2019/02/11/attack-of-the-week-searchable-encryption-and-the-ever-expanding-leakage-function/