Security
What Advanced Report Builder can read and write, what it stores, and what leaves your instance.
Two rules
A saved report is a saved question, not a saved answer. Running one goes through with_user(the person running it), so the enforcement is Odoo's own model access and record rules. Two people running the same definition get different numbers of rows, and a shared report never widens access.
A schedule runs as a named person, not as the administrator and not as "the system". The rows in the email are exactly the rows that person could have seen running it by hand. Without that, a schedule quietly becomes a way to email data past a permission boundary once a week, in writing.
A "run as" who cannot read the model is refused when the schedule is saved.
No expressions, anywhere
A column names a field. A filter is a domain. There is nowhere in a definition to put code. The moment a saved definition can carry code it becomes a way for one person to run something as another, and the permission argument collapses.
Field paths are resolved against the model and refused if they do not exist or are not stored - including sort and group-by fields.
Spreadsheet safety
Excel executes a cell beginning =, +, - or @ when the file is opened. A customer named =cmd|'/c calc'!A1 is a real attack, and it is a reporting tool's job not to hand it over primed. Every text cell with a leading formula character is prefixed with an apostrophe: invisible in the cell, inert to Excel.
Sharing
A definition with no groups is visible to every reader; one with groups is visible to those groups only. This governs who sees the definition. What each of them can read when they run it is decided by Odoo, on the underlying model, as them.
Roles
Creating a definition or a schedule requires the Designer role. Running one requires Reader. The split exists because defining a report that lands in twenty inboxes is a different decision from opening one.
Limits
- Row limits between 1 and 20,000 per definition.
- One hop through a relation; deeper paths are refused.
- Read-only: no write, create, delete or method call exists in the module.
Reporting a vulnerability
info@technovision.dev, with the Odoo version, the module version and enough detail to reproduce.