- Fix ACL test assumptions about browse() behavior
* Update tests to check field-level access instead of browse().exists()
* Correct test methodology for AccessError validation
- Implement buddy method pattern for RPC security
* Refactor all sudo()/api.model methods to use public/private pattern
* Public methods perform access checks, private methods contain privileged ops
* Prevents RPC privilege escalation vulnerabilities
- Enhanced security architecture
* Add comprehensive mail activity portal access rules
* Strengthen partner access controls
* Update controller method references to use secure public methods
- Test suite improvements
* Add extensive mail activity portal access tests
* Update player removal tests to use public method interfaces
* Improve test coverage for security scenarios
- Security best practices enforcement
* All privileged operations now encapsulated in private methods
* Clear separation between public API and internal operations
* Maintains functionality while securing RPC access
Resolves RPC security vulnerabilities and establishes proper ACL enforcement patterns.
- Refactor portal templates to eliminate intra-module template inheritance
- Integrate emergency contacts section into player injuries template
- Add full internal admin views for treatment notes with chatter support
- Fix ORM warning in test_rights by using proper ORM commands
- Update manifest to reflect new functionality (v18.0.1.9.0)
This refactoring improves template stability by removing XPath errors and
provides treatment professionals with better access to emergency contacts
and treatment notes both in portal and backend interfaces.
