Transaction cache override the current user
First of all, I don't know if this incident should be confidential, I set it as confidential just in case.
https://foss.heptapod.net/tryton/tryton/-/blob/2a6561df7ef67b695c947ee242e1af1960f12fa6/trytond/trytond/ir/routes.py#L187 I have only been able to replicate it in routes like this one. When changing user, as long as the transaction cache lasts, accessing, for example Transaction().user returns the cached user, not the current one.
Steps to reproduce
- Write print(Transaction().user) in route of the previous link.
- Open web browser, go to http://localhost:8000/database/data/party.party and login
- You can see in the terminal the correct user ID
- Close web browser and repeat step 2 but login with other user
- You can see in the terminal a wrong user ID
To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information