diff options
| author | Olivier Dony <odo@openerp.com> | 2011-01-27 16:51:58 +0100 |
|---|---|---|
| committer | Olivier Dony <odo@openerp.com> | 2011-01-27 16:51:58 +0100 |
| commit | 412d1766e230453e69dd3cb929022e751381da75 (patch) | |
| tree | 74f886a5dcfa7838dd6afa76089e407a496ad1db | |
| parent | d20312211de927933f61d2160da65578d44267b1 (diff) | |
[FIX] ir_attachment: typo introduced in previous fix (3319) (backport of trunk)
Original revision: 3319 - olt@tinyerp.com-20110125142329-x1sf2qlazfiy6bdw
The consequence is that access rights on attachments would be incorrectly checked, using the
intersection of the attachment IDs and the resource IDs.
bzr revid: odo@openerp.com-20110127155158-p9cn2vtqaqb914jn
| -rw-r--r-- | bin/addons/base/ir/ir_attachment.py | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/bin/addons/base/ir/ir_attachment.py b/bin/addons/base/ir/ir_attachment.py index af4c8c1861c..480d6782912 100644 --- a/bin/addons/base/ir/ir_attachment.py +++ b/bin/addons/base/ir/ir_attachment.py @@ -46,8 +46,11 @@ class ir_attachment(osv.osv): res_ids.setdefault(values['res_model'],[]).append(values['res_id']) for model, mids in res_ids.items(): - cr.execute('select id from '+self.pool.get(model)._table+' where id in %s', (tuple(ids),)) + # ignore attachments that are not attached to a resource anymore when checking access rights + # (resource was deleted but attachment was not) + cr.execute('select id from '+self.pool.get(model)._table+' where id in %s', (tuple(mids),)) mids = [x[0] for x in cr.fetchall()] + self.pool.get(model).check_access_rule(cr, uid, mids, mode, context=context) def search(self, cr, uid, args, offset=0, limit=None, order=None, |