6cfb9551b0
- Fix ACL test assumptions about browse() behavior * Update tests to check field-level access instead of browse().exists() * Correct test methodology for AccessError validation - Implement buddy method pattern for RPC security * Refactor all sudo()/api.model methods to use public/private pattern * Public methods perform access checks, private methods contain privileged ops * Prevents RPC privilege escalation vulnerabilities - Enhanced security architecture * Add comprehensive mail activity portal access rules * Strengthen partner access controls * Update controller method references to use secure public methods - Test suite improvements * Add extensive mail activity portal access tests * Update player removal tests to use public method interfaces * Improve test coverage for security scenarios - Security best practices enforcement * All privileged operations now encapsulated in private methods * Clear separation between public API and internal operations * Maintains functionality while securing RPC access Resolves RPC security vulnerabilities and establishes proper ACL enforcement patterns. |
||
|---|---|---|
| .. | ||
| ir.model.access.csv | ||
| mail_activity_portal_rules.xml | ||
| partner_access.xml | ||
| sports_clinic_groups.xml | ||
| sports_clinic_portal_groups.xml | ||
| sports_clinic_portal_rules.xml | ||
| sports_clinic_rules.xml | ||