6cfb9551b0
- Fix ACL test assumptions about browse() behavior * Update tests to check field-level access instead of browse().exists() * Correct test methodology for AccessError validation - Implement buddy method pattern for RPC security * Refactor all sudo()/api.model methods to use public/private pattern * Public methods perform access checks, private methods contain privileged ops * Prevents RPC privilege escalation vulnerabilities - Enhanced security architecture * Add comprehensive mail activity portal access rules * Strengthen partner access controls * Update controller method references to use secure public methods - Test suite improvements * Add extensive mail activity portal access tests * Update player removal tests to use public method interfaces * Improve test coverage for security scenarios - Security best practices enforcement * All privileged operations now encapsulated in private methods * Clear separation between public API and internal operations * Maintains functionality while securing RPC access Resolves RPC security vulnerabilities and establishes proper ACL enforcement patterns.
15 lines
737 B
XML
15 lines
737 B
XML
<?xml version="1.0" encoding="UTF-8"?>
|
|
<odoo>
|
|
<data noupdate="1">
|
|
<!-- Grant portal treatment professionals access to partners -->
|
|
<record id="access_res_partner_portal_treatment_professional" model="ir.model.access">
|
|
<field name="name">Portal Treatment Professional Access to Partners</field>
|
|
<field name="model_id" ref="base.model_res_partner"/>
|
|
<field name="group_id" ref="bemade_sports_clinic.group_portal_treatment_professional"/>
|
|
<field name="perm_read" eval="True"/>
|
|
<field name="perm_write" eval="True"/>
|
|
<field name="perm_create" eval="False"/>
|
|
<field name="perm_unlink" eval="False"/>
|
|
</record>
|
|
</data>
|
|
</odoo>
|