Access Denied by ACLs without reading the field

Bug #1106367 reported by Sergio Corato
28
This bug affects 4 people
Affects Status Importance Assigned to Milestone
Odoo Server (MOVED TO GITHUB)
Confirmed
Medium
OpenERP's Framework R&D

Bug Description

Hello,
I created a new form view of module product.product, which has a restricted field, standard_price.
I my new form I set only a field (name) but when I try to access it gives this error message:

Access Denied by ACLs for operation: read, uid: 4, model: product.product, fields: standard_price

This hasn't to happens, as I understand from http://doc.openerp.com/trunk/developers/server/04_security/?highlight=inherit#field-access-rights , or is it my fault?

Revision history for this message
Serpent Consulting Services (serpent-consulting-services) wrote :

Sergio,

Please make sure your user belongs to the group which you defined in the field.

Thanks.

Revision history for this message
Sergio Corato (icsergio) wrote :

I don't want that. My user belongs to portal user, and I want to show him only a part of the fields of product.product for which I created the form view.
Is it impossible?

Many thanks.

Revision history for this message
Serpent Consulting Services (serpent-consulting-services) wrote :

Sergio,

In Orderly manner, the user should have an access of the menu, model(product.product) for read and then the access of the field!

Make sure you satisfy the above criteria and then you can manage the access!

Thanks.

Revision history for this message
Sergio Corato (icsergio) wrote :

I meant I don't want to show this field to that user, because he isn't a normal user but a portal user, and I want him to see only some fields of product.product (he's outside of the company, he's not an employee).

Anyway, if I give that user (of portal group) the access to read the model (product.product) he can't read the field standard_price, because that field is accessible only to base_group users, and it's ok, but that deny message shoud not appear, and the user should be able to see the other fields not restricted.

Thank you very much.

Revision history for this message
Serpent Consulting Services (serpent-consulting-services) wrote :

I see, I will double check and see whats wrong !

This utility works normal here!

Changed in openobject-server:
assignee: nobody → OpenERP's Framework R&D (openerp-dev-framework)
importance: Undecided → Medium
status: New → Confirmed
Revision history for this message
LudoRA (tenshi20) wrote :

I use point_of_sale module in self service context. I have to allow point_of_sale.group_pos_user access to standard_price.

At this time, I have to override this fiels definition with a custom module. See attached patch that could be useful waiting a mainstream solution.

Revision history for this message
Ferdinand (office-chricar) wrote :

same problem here

the error message is INCOMPLETE and WRONG
************************
Access Denied

The requested operation cannot be completed due to security restrictions. Please contact your system administrator.

(Document type: Product, Operation: read)
************************

in the server log it says

Access Denied by ACLs for operation: read, uid: 12, model: product.product, fields: standard_price
and this is more helpful and must also be displayed to allow faster tracking of issues (as the Product can be read by everyone.)

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Duplicates of this bug

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.