Hi,
The issue4485 [1] exposed some bad default access right configuration.
Some models have limited access right for some groups but if user is in
any of those groups, he has full access because it misses a default
account right.
Here are by module the list of model missing such default access right:
- account_asset
- account.asset
- account.asset.line
- account_dunning
- account.dunning.procedure
- account.dunning.level
- account.dunning
- account_payment
- account.payment.journal
- account.payment.group
- account.payment
- account_payment_sepa
- account.payment.sepa.mandate
- account.payment.sepa.message
- account_statement
- account.statement
- account.statement.line
As the fix can not be backported (modification of XML), it is highly
recommended to set manually on your production databases those default
account right if you have one of those modules installed.
There will be no issue for the upgrade later as both (manual and XML)
access right can coexist.
A generic will be added to prevent such issue in the future.
[1] https://bugs.tryton.org/issue4485
--
Cédric Krier - B2CK SPRL
Email/Jabber: [email protected]
Tel: +32 472 54 46 59
Website: http://www.b2ck.com/
