Merge lp:~cubicerp/openobject-server/7.0-fix-bug-1073087-multicompany-access-denied into lp:openobject-server/7.0

[Cubic ERP]

Patch to fix the bug 1073087 multi company Access Denied Document type: Partner, Operation: read

https://bugs.launchpad.net/openobject-addons/+bug/1073087

[Olivier Dony (Odoo) (odo-openerp)]

Hello,

Thanks for taking the time to submit a patch to fix this issue.

Unfortunately your patch is not correct, what it does will break the access right system of OpenERP. It would allow users to bypass all access rules and perform operations on records on unauthorized records as long as they also touch one record that they can access - this is a dangerous security hole.

In addition the root cause of the problem here is no the security rules system but a synchronization issue between the "company_id" of the current user and the "company_id" of the partner linked to the current user. This is the part that needs to be fixed, not the rules system or the rules themselves.

For more details you can have a look at this other merge proposal that attempts to fix the issue:
   https://code.launchpad.net/~openerp-dev/openobject-server/7.0-opw-591308-jam/+merge/158311

Thanks again for your contribution!

review: Disapprove

[Cubic ERP (cubicerp)]

Dear Oliver, please explain me about your test realized to you said:

"... what it does will break the access right system of OpenERP. It would allow users to bypass all access rules and perform operations on records on unauthorized records as long as they also touch one record that they can access - this is a dangerous security hole..."

I need review your tests because on my tests it isn't a security hole.

best regards.

Unmerged revisions

4870. By Cubic ERP on 2013-03-04

[FIX] _check_record_rules_result_count on missing_ids, wrong message Access Denied by record rules operation

=== modified file 'openerp/osv/orm.py'
--- openerp/osv/orm.py	2013-02-11 14:36:47 +0000
+++ openerp/osv/orm.py	2013-03-04 19:42:22 +0000
@@ -3847,7 +3847,7 @@
            the length of `ids`, and raise an appropriate exception if it does not.
         """
         ids, result_ids = set(ids), set(result_ids)
-        missing_ids = ids - result_ids
+        missing_ids = not (result_ids.issubset(ids) and result_ids) and ids - result_ids #YT 3/3/2013 #ids - result_ids
         if missing_ids:
             # Attempt to distinguish record rule restriction vs deleted records,
             # to provide a more specific error message - check if the missinf