Odoo 11 Development Essentials - Third Edition

Accessing the security and menu item

Since this generic form handling is quite open, and processes untrusted data sent by the client, the creation of new records is done in sudo mode (with the same powers as the Admin), which means that potentially anyone can insert records into the database.

For security reasons, we need some server-side setup on what the client is allowed to do. Because of this, Models accepting website_form data must be whitelisted, as well as the specific list of fields that can be written on.

Still, the /website_form/<string:model_name> route is public and will happily insert data into any model that has been whitelisted, unless you implement some extra security checks. This can be done using the website_form_input_filter() ...