odoo
[FW][IMP] http: allow deactivating generation of res.device.log per session
In some situations it is useful to avoid generating useless device logs, e.g. for automated technical sessions, platform-generated request, etc.
This commit introduces support for a _trace_disable session flag to do so. This should never be done without a proper assessment of the consequences for auditability, as seen from the user's point of view.
Note that non-admin users have no direct or indirect way to set this flag, so it shouldn't be an extra security risk. Privileged users would have different technical ways to set it, but they could just as easily delete the generated logs or modify them.
Also noteworthy: such sessions will of course still be subject to all other auditing mechanisms (server logs, web proxy logs, metadata tracking on modified records, etc.)
Forward-Port-Of: odoo/odoo#179413
@odony this PR targets master and is the last of the forward-port chain containing:
- odoo/odoo#182246
To merge the full chain, use
@robodoo r+
More info at https://github.com/odoo/odoo/wiki/Mergebot#forward-port
