Skip to content

security(grm): plain internal users can read every grievance ticket (no base.group_user record rule) #486

Description

@gonzalesedwin1123

spp_grm/security/ir.model.access.csv grants base.group_user unscoped read on spp.grm.ticket, and no ir.rule on the model targets base.group_user (all six rules in rules.xml are group rules for GRM roles/portal). Odoo's rule evaluation leaves a user who matches no rule unrestricted — so any internal account with no GRM group (registry clerk, finance, farm user) reads every grievance in the database over RPC: complainant identity, free-text description. Perversely, granting someone group_grm_viewer narrows them to their own tickets.

Same class of hole as the portal one fixed by #380 / PR #415 (found during that PR's review — thread on ir.model.access.csv:5). Pre-existing, not introduced there.

Constraint discovered during verification: do NOT drop the ACL row — spp_grm/models/res_partner.py:19-26 (_compute_grm_ticket_count) runs an unsudo'd search on spp.grm.ticket for every internal user opening a partner form; removing read access breaks that form for non-GRM staff.

Proposed fix: add a base.group_user record rule, e.g.

['|', ('user_id', '=', user.id), ('partner_id', '=', user.partner_id.id)]

Group rules OR together, so GRM roles keep their existing scopes; the partner compute degrades to a scoped count. Decide deliberately whether intake/triage staff need anything broader before landing. Behavior change for all internal users — needs its own release-note entry.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions