diff options
| author | Martin Trigaux <mat@odoo.com> | 2020-09-01 12:27:32 +0000 |
|---|---|---|
| committer | Martin Trigaux <mat@odoo.com> | 2020-09-04 09:45:10 +0000 |
| commit | efc0263b2574fa355ea794514eb3285d8c449260 (patch) | |
| tree | c4ac81d0f9f317509b71782b5e86d08f17be57a8 | |
| parent | 4d43a301fd10cfeb498d9bf6b614779e26e12d16 (diff) | |
[IMP] base: implement comment
Forgotten TODO
Instead of checking in _for_xml_id (where 99% of calls are static),
verify on the few calls that accept an arbitrary argument
closes odoo/odoo#56876
Related: odoo/enterprise#12844
Signed-off-by: Martin Trigaux (mat) <mat@odoo.com>
| -rw-r--r-- | addons/web/models/base_document_layout.py | 4 | ||||
| -rw-r--r-- | odoo/addons/base/models/ir_actions.py | 2 |
2 files changed, 3 insertions, 3 deletions
diff --git a/addons/web/models/base_document_layout.py b/addons/web/models/base_document_layout.py index 47ccd2114e9..8d26f61e2f7 100644 --- a/addons/web/models/base_document_layout.py +++ b/addons/web/models/base_document_layout.py @@ -216,7 +216,9 @@ class BaseDocumentLayout(models.TransientModel): def action_open_base_document_layout(self, action_ref=None): if not action_ref: action_ref = 'web.action_base_document_layout_configurator' - return self.env["ir.actions.actions"]._for_xml_id(action_ref) + res = self.env["ir.actions.actions"]._for_xml_id(action_ref) + self.env[res["res_model"]].check_access_rights('write') + return res def document_layout_save(self): # meant to be overridden diff --git a/odoo/addons/base/models/ir_actions.py b/odoo/addons/base/models/ir_actions.py index 0934e7f38f4..929478426d1 100644 --- a/odoo/addons/base/models/ir_actions.py +++ b/odoo/addons/base/models/ir_actions.py @@ -139,14 +139,12 @@ class IrActions(models.Model): def _for_xml_id(self, full_xml_id): """ Returns the action content for the provided xml_id - :param module: the module the act_window originates in :param xml_id: the namespace-less id of the action (the @id attribute from the XML file) :return: A read() view of the ir.actions.action safe for web use """ record = self.env.ref(full_xml_id) assert isinstance(self.env[record._name], type(self)) - # TO CHECK MAT: check groups_id/res_model access? action = record.sudo().read()[0] return { field: value |