spp_grm/security/ir.model.access.csv grants base.group_user unscoped read on spp.grm.ticket, and no ir.rule on the model targets base.group_user (all six rules in rules.xml are group rules for GRM roles/portal). Odoo's rule evaluation leaves a user who matches no rule unrestricted — so any internal account with no GRM group (registry clerk, finance, farm user) reads every grievance in the database over RPC: complainant identity, free-text description. Perversely, granting someone group_grm_viewer narrows them to their own tickets.
Same class of hole as the portal one fixed by #380 / PR #415 (found during that PR's review — thread on ir.model.access.csv:5). Pre-existing, not introduced there.
Constraint discovered during verification: do NOT drop the ACL row — spp_grm/models/res_partner.py:19-26 (_compute_grm_ticket_count) runs an unsudo'd search on spp.grm.ticket for every internal user opening a partner form; removing read access breaks that form for non-GRM staff.
Proposed fix: add a base.group_user record rule, e.g.
['|', ('user_id', '=', user.id), ('partner_id', '=', user.partner_id.id)]
Group rules OR together, so GRM roles keep their existing scopes; the partner compute degrades to a scoped count. Decide deliberately whether intake/triage staff need anything broader before landing. Behavior change for all internal users — needs its own release-note entry.
spp_grm/security/ir.model.access.csvgrantsbase.group_userunscoped read onspp.grm.ticket, and noir.ruleon the model targetsbase.group_user(all six rules inrules.xmlare group rules for GRM roles/portal). Odoo's rule evaluation leaves a user who matches no rule unrestricted — so any internal account with no GRM group (registry clerk, finance, farm user) reads every grievance in the database over RPC: complainant identity, free-text description. Perversely, granting someonegroup_grm_viewernarrows them to their own tickets.Same class of hole as the portal one fixed by #380 / PR #415 (found during that PR's review — thread on
ir.model.access.csv:5). Pre-existing, not introduced there.Constraint discovered during verification: do NOT drop the ACL row —
spp_grm/models/res_partner.py:19-26(_compute_grm_ticket_count) runs an unsudo'dsearchonspp.grm.ticketfor every internal user opening a partner form; removing read access breaks that form for non-GRM staff.Proposed fix: add a
base.group_userrecord rule, e.g.Group rules OR together, so GRM roles keep their existing scopes; the partner compute degrades to a scoped count. Decide deliberately whether intake/triage staff need anything broader before landing. Behavior change for all internal users — needs its own release-note entry.