diff options
| author | Raphael Collet <rco@openerp.com> | 2016-11-25 10:01:14 +0100 |
|---|---|---|
| committer | Raphael Collet <rco@openerp.com> | 2017-01-03 16:52:49 +0100 |
| commit | 5d746d0ac663232d656bb57e82fec290bb5d82fd (patch) | |
| tree | f1d51602745c28b43ab84a309fcbc7080c60e5c9 /addons/mail/models/mail_alias.py | |
| parent | 1abd543f1412cf16953fd28659baabf1e4df6010 (diff) | |
[IMP] base, *: tighten `ir.model` access rights
Remove unrestricted "read" access. To make code internally using `ir.model`
work, add a private method `_get` on `ir.model` to retrieve the record
corresponding to a model name, without access rights issue.
Change signature of method `get_authorized_fields` to make it use a model name
instead of a model id. This removes the necessity of a search on `ir.model`.
Diffstat (limited to 'addons/mail/models/mail_alias.py')
| -rw-r--r-- | addons/mail/models/mail_alias.py | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/addons/mail/models/mail_alias.py b/addons/mail/models/mail_alias.py index eee18d10c5b..07d6bfb3d58 100644 --- a/addons/mail/models/mail_alias.py +++ b/addons/mail/models/mail_alias.py @@ -111,10 +111,10 @@ class Alias(models.Model): if vals.get('alias_name'): vals['alias_name'] = self._clean_and_make_unique(vals.get('alias_name')) if model_name: - model = self.env['ir.model'].search([('model', '=', model_name)]) + model = self.env['ir.model']._get(model_name) vals['alias_model_id'] = model.id if parent_model_name: - model = self.env['ir.model'].search([('model', '=', parent_model_name)]) + model = self.env['ir.model']._get(parent_model_name) vals['alias_parent_model_id'] = model.id return super(Alias, self).create(vals) |