[FIX] app_common: security

app_common/models/base.py

@@ -51,6 +51,12 @@ EXCLU_FIELDS = [
 class Base(models.AbstractModel):
     _inherit = 'base'
 
+    @api.model
+    def _app_check_sys_op(self):
+        if self.env.user.has_group('base.group_erp_manager'):
+            return True
+        return False
+
     @api.model
     def _get_normal_fields(self):
         f_list = []
@@ -97,7 +103,9 @@ class Base(models.AbstractModel):
         return dt.astimezone(pytz_timezone).strftime(return_format)
 
     @api.model
-    def get_image_from_url(self, url):
+    def _get_image_from_url(self, url):
+        if not self._app_check_sys_op():
+            return False
         if not url:
             return None
         try: