# Proteus allows changing read-only fields?

**URL:** <https://discuss.tryton.org/t/proteus-allows-changing-read-only-fields/4637>\
**Category:** Developer\
**Created:** [September 18, 2021, 6:25pm UTC](https://discuss.tryton.org/t/proteus-allows-changing-read-only-fields/4637 "2021-09-18T18:25:58Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![htgoebel](https://discuss-cdn.tryton.org/user_avatar/discuss.tryton.org/htgoebel/32/1256_2.png) [@htgoebel](https://discuss.tryton.org/u/htgoebel)\
**Post date:** [September 18, 2021, 6:25pm UTC](https://discuss.tryton.org/t/proteus-allows-changing-read-only-fields/4637/1 "2021-09-18T18:25:58Z")

</div>

I try to write some constraint tests for a model, to check whether the implementation matches the specification. Anyhow, given `Member.code` defined as below, I can change `code` even if `state != 'draft'`

```auto
class Member(Workflow, ModelSQL, ModelView):
    # […]
    code = fields.Char("Code", select=True,
        states={
            'readonly': Eval('state') != 'draft',
            'required': Eval('state') != 'draft'
            },
        depends=['state'],
        help="The internal identifier for the associate.")

```

Excerpt from doc-test:

```auto
   >>> member.state
   'running'
   >>> member.code = 'some-other-code'
   >>> member.save() # <<== I except this to fail, but it does not
   >>> member.reload()
   >>> assert member2.code != 'some-other-code' # <<== same here

```

Is this worth a bug-report?

---

<div class="post-metadata">

**Author:** ![ced](https://discuss-cdn.tryton.org/user_avatar/discuss.tryton.org/ced/32/1237_2.png) [@ced](https://discuss.tryton.org/u/ced)\
**Post date:** [September 18, 2021, 9:33pm UTC](https://discuss.tryton.org/t/proteus-allows-changing-read-only-fields/4637/2 "2021-09-18T21:33:12Z")

</div>

No because we do not care about client enforcing access, it must be done on server side [Enforce readonly on field (#4207) · Issues · Tryton / Tryton · GitLab](https://bugs.tryton.org/issue4207)

---

<div class="post-metadata">

**Author:** ![system](https://discuss-cdn.tryton.org/uploads/default/original/1X/c6f8ec0a40525cdcd50058c734283450a4b3d38b.png) [@system](https://discuss.tryton.org/u/system)\
**Post date:** [October 18, 2021, 9:33pm UTC](https://discuss.tryton.org/t/proteus-allows-changing-read-only-fields/4637/3 "2021-10-18T21:33:42Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.