[7.0] SUPERUSER_ID passed instead of real uid to get the value of related field

[dskarataev]

Hello there,

I have inherited the function that returns value of "virtual_available" field in product.product. Also in another model I have field with type=related that points to the "virtual_available" in the product.product.

I had the problem with wrong uid in my inherited function "_product_available()" and I was debugging looking for place that replace my uid to SUPERUSER_ID, and finally I got it. It's the method "_fnct_read" in osv.fields and this method put SUPERUSER_ID instead my uid in hard way to get the value.

It means that it is security error and user that doesn't have the right to read value of field in related model CAN DO IT NOW.

Please check this out and give me your feedback. @rco-odoo @xmo-odoo

[yann-papouin]

https://bugs.launchpad.net/openobject-server/+bug/1123018

[dskarataev]

Thanks @yann-papouin, I've read your link. But anyway security it's just one thing in this question. Also wrong uid is passed to the function and it's not right. Yes, if uid would be used just to give more access to read the value of the field, it's ok. But in my situation this function also returns different value for different uid and it's pity that OpenERP can't handle this sutuation. Of course, I've already rewrited my module and changed "related" type to the "function" that handles the situation properly, but anyway I don't think the original solution for "related" fields is good.

[Yenthe666]

Hi @dskarataev,

Thank you for your bug report and our apoligies that we haven't had the time to look at this bug report. We do our best to handle all of them, but we sometimes miss some.
At this point Odoo 7 & Odoo 8 is no longer supported as Odoo only supports three versions (9.0, 10.0, 11.0 at the moment).
If you can still reproduce this issue on Odoo 9, Odoo 10 or Odoo 11 we encourage you to create a new bug report.

Regards,
Yenthe