Skip to content
GitLab
Projects Groups Snippets
  • /
  • Help
    • Help
    • Support
    • Community forum
    • Submit feedback
    • Contribute to GitLab
  • Sign in / Register
  • Tryton Tryton
  • Project information
    • Project information
    • Activity
    • Labels
    • Members
  • Repository
    • Repository
    • Files
    • Commits
    • Branches
    • Tags
    • Contributors
    • Graph
    • Compare
  • Issues 710
    • Issues 710
    • List
    • Boards
    • Service Desk
    • Milestones
  • Merge requests 56
    • Merge requests 56
  • CI/CD
    • CI/CD
    • Pipelines
    • Jobs
    • Schedules
  • Deployments
    • Deployments
    • Releases
  • Analytics
    • Analytics
    • Value stream
    • CI/CD
    • Repository
  • External wiki
    • External wiki
  • Activity
  • Graph
  • Create a new issue
  • Jobs
  • Commits
  • Issue Boards
Collapse sidebar

April 05-07 - Mercurial Paris Conference 2023 - One day of workshop dedicated to Heptapod and Mercurial usage and workflow. There are still places available for both workshops and talks!

  • TrytonTryton
  • TrytonTryton
  • Issues
  • #12108
Closed
Open
Issue created Feb 24, 2023 by José Antonio Díaz Miralles@tiyujopiteDeveloper

Transaction cache override the current user

First of all, I don't know if this incident should be confidential, I set it as confidential just in case.

https://foss.heptapod.net/tryton/tryton/-/blob/2a6561df7ef67b695c947ee242e1af1960f12fa6/trytond/trytond/ir/routes.py#L187 I have only been able to replicate it in routes like this one. When changing user, as long as the transaction cache lasts, accessing, for example Transaction().user returns the cached user, not the current one.

Steps to reproduce

  1. Write print(Transaction().user) in route of the previous link.
  2. Open web browser, go to http://localhost:8000/database/data/party.party and login
  3. You can see in the terminal the correct user ID
  4. Close web browser and repeat step 2 but login with other user
  5. You can see in the terminal a wrong user ID
To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information
Assignee
Assign to
Time tracking