[18.0][OU-FIX] web_tour: drop obsolete per-user security rules#9
Open
eantones wants to merge 1 commit into
Open
[18.0][OU-FIX] web_tour: drop obsolete per-user security rules#9eantones wants to merge 1 commit into
eantones wants to merge 1 commit into
Conversation
web_tour.tour lost its user_id field in 18.0, but a pre-existing
per-user record rule ("own tours", domain [('user_id','=',user.id)])
survives the migration and now references a nonexistent field. Since
tours are loaded at every web login, evaluating that stale rule blocks
ALL logins right after a 17->18 migration.
Remove such rules in the module's end-migration, after its own data has
been reloaded. Reported upstream as issue 5365 on the OCA OpenUpgrade
tracker, which proposes exactly this cleanup; submitted here on the fork
so the 17->18 hop can ride it before it lands upstream.
eantones
added
the
upstream-candidate
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
web_tour.tour lost its user_id field in 18.0, but a pre-existing per-user record rule ("own tours", domain
[('user_id','=',user.id)]) survives the migration and now references a nonexistent field. Tours are loaded at every web login, so evaluating the stale rule blocks ALL logins right after a 17->18 migration.This adds the cleanup to web_tour's end-migration, after the module's own data has been reloaded: delete record rules on web_tour.tour whose domain references user_id.
Reported upstream as issue 5365 on the OCA OpenUpgrade tracker (which proposes exactly this cleanup); carried on the fork so our 17->18 hop rides it until it lands upstream. Upstreamable as-is.