Skip to content
GitLab
  • Menu
Projects Groups Snippets
  • /
  • Help
    • Help
    • Support
    • Community forum
    • Submit feedback
    • Contribute to GitLab
  • Sign in / Register
  • Tryton Tryton
  • Project information
    • Project information
    • Activity
    • Labels
    • Members
  • Repository
    • Repository
    • Files
    • Commits
    • Branches
    • Tags
    • Contributors
    • Graph
    • Compare
  • Issues 790
    • Issues 790
    • List
    • Boards
    • Service Desk
    • Milestones
  • Merge requests 77
    • Merge requests 77
  • CI/CD
    • CI/CD
    • Pipelines
    • Jobs
    • Schedules
  • Deployments
    • Deployments
    • Releases
  • Analytics
    • Analytics
    • Value stream
    • CI/CD
    • Repository
  • External wiki
    • External wiki
  • Activity
  • Graph
  • Create a new issue
  • Jobs
  • Commits
  • Issue Boards
Collapse sidebar
  • Tryton
  • TrytonTryton
  • Issues
  • #11693
Closed
Open
Created Sep 09, 2022 by Cédric Krier@cedOwner

Enforce field access on xxx2Many fields

When defining create and delete access on xxx2Many fields, they are just followed by the clients (disabling buttons). But we could also enforce them on the server side of the field. For now only read and write accesses are enforced by ModelStorage. This is not really a security issue because without a direct access restriction on the target model, it is still possible to call directly the ModelStorage.create and ModelStorage.delete on the target. But for consistency it will be good to enforce it on the server side.

To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information
Assignee
Assign to
Time tracking