Trying to study OpenERP, I am confusing somewhere here. I infer the following. Would be quite helpful to get some comments and confirmations.

1. Partner object holds Customers and Suppliers. There are not any separate Objects for these. In stead, two boolean fields named 'customer' and 'supplier' in Partner indicate whether it is a customer or supplier.

2. There is a 'user_id' field in Partner labeled 'Dedicated Salesman'. Is this the ID using which Partners login?

3. There is a separate Employee object. There is no relationship between Employee and Partner!

I don't understand why Employee-User is a many2one relationship. Similarly, why Partner-User is a many2one relationship.

thanks,
_________________
Sanjay
RAD Solutions Private Limited
sanjay at radsolutions co in

Hi Husen,

Thanks for the responses. Needing some more inputs:

[quote="hda"]

Quote:

2. There is a 'user_id' field in Partner labeled 'Dedicated Salesman'. Is this the ID using which Partners login?

If you want to compute salesman's commission and dedicate salesman to particular partner (customer or supplier) then you can select your employee (salesman) who is going to handle those partners.

Is a partner (customer or supplier) logging in directly currently supported ? If yes, which field in partner is used for the link?

Quote:

There is a separate Employee object. There is no relationship between Employee and Partner!

There is a relationship through dedicated salesman between employee and partner.

You mean like this: Employee<User>Partner?

Quote:

I don't understand why Employee-User is a many2one relationship. Similarly

Employee-user relationship is for providing user rights and login to employee.[/quote]

Any specific reason why it is many2one and not one2one?

thanks a lot,
_________________
Sanjay
RAD Solutions Private Limited
sanjay at radsolutions co in

you need to create separate user for customer and supplier to provide them login.
there is no relationship for partner-user.
you need to customize partner for that.
_________________
OpenERP=Easier, Adaptable, Affordable, Modular

Ok.

Might be a naive question but not yet understood why Employee-User is many2one and not one2one. Any specific thoughts?

thanks,
_________________
Sanjay
RAD Solutions Private Limited
sanjay at radsolutions co in

But anyway you should be very cautious when providing a system login for external party, because there is a bug which allows changing identity. This and similar bugs are present (and known) on system at least for couple of years now, and in latest stable version inclusive. So it renders use of TERP for direct customer interaction, extremely unsafe.

sraps

[quote="sraps"]But anyway you should be very cautious when providing a system login for external party, because there is a bug which allows changing identity. This and similar bugs are present (and known) on system at least for couple of years now, and in latest stable version inclusive. So it renders use of TERP for direct customer interaction, extremely unsafe.

sraps[/quote]

Thanks a lot, Sraps. It is really a vital input.

Does this bug existing from two years mean that there is some architectural constraint and this bug can not be removed? Are there plans to remove this bug in 5.0? Need more inputs, as this might be vital to our projects.

Would appreciate all possible references on these bugs and ways to circumvent these, if any.
_________________
Sanjay
RAD Solutions Private Limited
sanjay at radsolutions co in

Oh - my mistake, I see, again when I am not talking up to your official mind, I am wrong... .

These are just about one half of the problem:
http://openerp.com/forum/topic7743.html
http://openerp.com/forum/topic6389.html
http://openerp.com/forum/topic2449.html
http://openerp.com/forum/topic4213.html
http://openerp.com/forum/topic3725.html
http://openerp.com/forum/topic896.html

I tried to secure OpenERP, not to allow one user to read info not intended him to see. There are 2 things that should be done - remove access to the menu's and to the models that user should not access. But there is one model that could not be restricted - res.users. If we restrict this medel to let's say admin, no one else are able to log in. And this is where still plaintext password lives.

I am very sorry not to find anymore the topic where Fabien himself have proposed a patch - as I remember more or less working python code snippet to replace a password field with hashed result. But anyway these bugs are well known, but are not implemented. (I do not know of 5th version, have not tried yet.)

Ok, I tried to build a small perl script (I like this language, and consider it more mature), which logs in as unprivileged user through XML-RPC connection and reads unrestricted res.users model. And this is where you can find any and every login information.

This is true and tried by myself.

Why I have not submitted a patch for this? There are several reasons for this, and you can find them in my other posts. Anyway there are not only me who thinks, that there should be paid more attention to maturity and stability not only new features.

Recently I discovered a fork for this system called (could be found on tryton.org) Tryton, which aims to fix these issues. This is their policy, do not know how well they are at implementing it, have not tried it yet, although they have a release.

But to me this is clear result for lack of respect and attention to an ordinary contributor, remember German translations and contributions. Ah well, they were wrong too.

Though this absolutely is not good to divide force.

P.S. It should be better if such advocates as gegard would spend a little more time to test not just blindly oppose. Just think, who would spend time to discover things like this, if one would be "fake"?

Good day!
-sraps

When you make inflammatory statements with no evidence you can either be ignored or be challenged to produce your evidence. Without evidence, we were not sure that the security we put in place was sufficient.

Thank you for now providing your evidence.

sraps wrote:

I do not know of 5th version, have not tried yet.

Perhaps you should. But it's not necessary to go to version 5 to implement an OpenERP system that's secure for its situation.
_________________
Regards,
Geoff
Seath Solutions Ltd

Would be watching this thread to get further updates such as version 5 status etc.

thanks,
_________________
Sanjay
RAD Solutions Private Limited
sanjay at radsolutions co in