6cfb9551b0
- Fix ACL test assumptions about browse() behavior * Update tests to check field-level access instead of browse().exists() * Correct test methodology for AccessError validation - Implement buddy method pattern for RPC security * Refactor all sudo()/api.model methods to use public/private pattern * Public methods perform access checks, private methods contain privileged ops * Prevents RPC privilege escalation vulnerabilities - Enhanced security architecture * Add comprehensive mail activity portal access rules * Strengthen partner access controls * Update controller method references to use secure public methods - Test suite improvements * Add extensive mail activity portal access tests * Update player removal tests to use public method interfaces * Improve test coverage for security scenarios - Security best practices enforcement * All privileged operations now encapsulated in private methods * Clear separation between public API and internal operations * Maintains functionality while securing RPC access Resolves RPC security vulnerabilities and establishes proper ACL enforcement patterns. |
||
|---|---|---|
| .. | ||
| controllers | ||
| data | ||
| i18n | ||
| migrations/18.0.1.7.0 | ||
| models | ||
| notes | ||
| security | ||
| static/description | ||
| tests | ||
| views | ||
| __init__.py | ||
| __manifest__.py | ||
| TODO.md | ||