Comments (9)
ping @gurneyalex @pedrobaeza @StefanRijnhart - I'd be curious about your opinion on this one
from server-tools.
@ALL I'm just as curious about your opinions too of course
from server-tools.
Hi, @hbrunn, you can define record rules to restrict operations depending on a domain, which is similar to what you are doing. Have you checked that option? What I don't know is how multiple record rules mix together.
from server-tools.
@pedrobaeza in my project, I use record rules on top of that. Record rules restrict which records a user can execute an action on, but here, the requirement is that users are allowed to see all partners, but only specified fields. And it has to be a hard restriction as opposed to just hide some fields in the UI (this can be circumvented by using xmlrpc or the like)
How multiple record rules mix is as follows:
- all group-specific record rules are combined with
AND
- all not group-specific record rules are combined with
OR
- the two above are combined with
AND
This has the sometimes counter intuitive result that adding a user to a group actually makes her see less records.
But well, another topic, let's keep talking about field level access restrictions ;-)
from server-tools.
Hi, Holger, thanks for the explanation about the record rules. Indeed, I read very fast and didn't take into account about your intention of protecting only certain fields, not at record level.
Commenting on the code you present, I would't put a whitelist, but allow all the fields by default. On contrary, each module that adds a field will need to explicitely inherit your mixin and add itself to whitelist.
I also don't understand why you need two methods to deal with the restriction: _restrict_field_access_inject_restrict_field_access_domain and _restrict_field_access_is_field_accessible
from server-tools.
Thanks for your points. The whitelist is indeed quite specific to the customer, I think in the end there'll be a function for a whitelist and one for a blacklist, both empty, and if the user (=programmer) doesn't fill one of them, nothing happens.
_restrict_field_access_inject_restrict_field_access_domain
allows you to rewrite the attrs
attribute on a form, _restrict_field_access_is_field_accessible
is a helper function programmers can use to have the logic about whether a field is accessible or not at one central place.
from server-tools.
OK, I like then the possibilities this brings. You can make a server-tools module or wait for another opinion, but I think this deserves a module.
from server-tools.
@hbrunn i did not take a deep look at your code, but i really like the idea. For us, in some projects we need to create some function fields to store values and do the restriction based on these function fields. I'm looking forward to see your module ;)
from server-tools.
I made a PR in #396, so I'll close this one
from server-tools.
Related Issues (20)
- base_name_search_improved: can't be configured
- multi_image in product.product HOT 1
- product_multi_image odoo module
- Frontend integration for sentry HOT 1
- upgrade_analysis: Odoo-version HOT 5
- [16.0] excel_import_export: template cannot be found if it is created by duplicating another template
- Migration to version 17.0 HOT 23
- Database Auto-Backup fails on pg_dump error HOT 6
- [16] base_sequence_default - Improve readme HOT 1
- problème d'installation module auditlog HOT 1
- How to Install auditlog module. HOT 1
- [17.0] module views_migration_17 - [Errno 30] Read-only file system: '/opt/odoo/custom/src/odoo/odoo/addons/base/views/ir_actions_views.xml'
- Auditlog does not log changes to Reordering Rules if user does not hit "enter" or click "Save". HOT 1
- [15.0] base_fontawesome: broken icons when updgrade HOT 1
- [16.0] database_cleanup - Purge columns purges totp_secret, resulting in server crash HOT 1
- Separate tools into different repos HOT 2
- Create a neutralized database backup HOT 6
- 14.0: Errors on uninstalling `tracking_manager` HOT 1
- [16.0] Tests failing: cron_daylight_saving_time_resistant HOT 1
- [17.0] auto_backup - fail or disk space alert
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from server-tools.