Proteus allows changing read-only fields?

[htgoebel (Hartmut Goebel)]

I try to write some constraint tests for a model, to check whether the implementation matches the specification. Anyhow, given Member.code defined as below, I can change code even if state != 'draft'

class Member(Workflow, ModelSQL, ModelView):
    # […]
    code = fields.Char("Code", select=True,
        states={
            'readonly': Eval('state') != 'draft',
            'required': Eval('state') != 'draft'
            },
        depends=['state'],
        help="The internal identifier for the associate.")

Excerpt from doc-test:

   >>> member.state
   'running'
   >>> member.code = 'some-other-code'
   >>> member.save() #  <<== I except this to fail, but it does not
   >>> member.reload()
   >>> assert member2.code != 'some-other-code'    # <<== same here

Is this worth a bug-report?

[ced (Cédric Krier)]

No because we do not care about client enforcing access, it must be done on server side Issue 4207: Enforce readonly on field - Tryton issue tracker