diff options
| author | Martin Trigaux <mat@odoo.com> | 2020-06-19 13:02:34 +0000 |
|---|---|---|
| committer | Martin Trigaux <mat@odoo.com> | 2020-08-17 09:08:23 +0000 |
| commit | d5c16492397047ceb97a0879aa61f068a0eeeca8 (patch) | |
| tree | ea2de631dcabee0a59c22b927ce0b5cbd8d6af12 /addons/fleet | |
| parent | e6e0eafccd483e2b002b45b514181c8ce4238b0d (diff) | |
[IMP] base,web: _for_xml_id as a safe access point
/web/action/load is the public controller that Should be used by the
webclient to fetch actions
_for_xml_id is the default access method on actions that implements
fields filtering to avoid leaking server action code or other
information not needed by the webclient
Implementing whitelist of fields that can be access per model
Diffstat (limited to 'addons/fleet')
| -rw-r--r-- | addons/fleet/models/fleet_vehicle.py | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/addons/fleet/models/fleet_vehicle.py b/addons/fleet/models/fleet_vehicle.py index e2498f854d7..87519bdafd0 100644 --- a/addons/fleet/models/fleet_vehicle.py +++ b/addons/fleet/models/fleet_vehicle.py @@ -281,7 +281,8 @@ class FleetVehicle(models.Model): self.ensure_one() xml_id = self.env.context.get('xml_id') if xml_id: - res = self.env['ir.actions.act_window'].for_xml_id('fleet', xml_id) + + res = self.env['ir.actions.act_window']._for_xml_id('fleet.%s' % xml_id) res.update( context=dict(self.env.context, default_vehicle_id=self.id, group_by=False), domain=[('vehicle_id', '=', self.id)] @@ -296,7 +297,7 @@ class FleetVehicle(models.Model): self.ensure_one() copy_context = dict(self.env.context) copy_context.pop('group_by', None) - res = self.env['ir.actions.act_window'].for_xml_id('fleet', 'fleet_vehicle_costs_action') + res = self.env['ir.actions.act_window']._for_xml_id('fleet.fleet_vehicle_costs_action') res.update( context=dict(copy_context, default_vehicle_id=self.id, search_default_parent_false=True), domain=[('vehicle_id', '=', self.id)] |