Odoo15 安全，我可以看到不可见的字段或组

Question

I have a question about the Odoo Security.

Ass you can see, there is no button in the picture below. Because the button is invisible depends on the attrs.

For example this code:

attrs="{'invisible': [('purchase_approve_admin', ',=', 'neutral')]}"

But i can change this state from source code.

Like this:

I can control odoo forms' attrs from here.

So the buttons is visible.

Final:

Question is, How can i prevent this problem?

Answer 1

Make a separate group like " group_approve_ceo " and assign it to your field, button, or menu. Only assign this group to the CEO or user who should have access

<button name="compute_purchase_approve_ceo"   type="object" class="btn btn-primary" groups="model_name.group_approve_ceo"/>