diff options
| author | Raphael Collet <rco@openerp.com> | 2016-11-25 10:01:14 +0100 |
|---|---|---|
| committer | Raphael Collet <rco@openerp.com> | 2017-01-03 16:52:49 +0100 |
| commit | 5d746d0ac663232d656bb57e82fec290bb5d82fd (patch) | |
| tree | f1d51602745c28b43ab84a309fcbc7080c60e5c9 /addons/mail/models/mail_thread.py | |
| parent | 1abd543f1412cf16953fd28659baabf1e4df6010 (diff) | |
[IMP] base, *: tighten `ir.model` access rights
Remove unrestricted "read" access. To make code internally using `ir.model`
work, add a private method `_get` on `ir.model` to retrieve the record
corresponding to a model name, without access rights issue.
Change signature of method `get_authorized_fields` to make it use a model name
instead of a model id. This removes the necessity of a search on `ir.model`.
Diffstat (limited to 'addons/mail/models/mail_thread.py')
| -rw-r--r-- | addons/mail/models/mail_thread.py | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/addons/mail/models/mail_thread.py b/addons/mail/models/mail_thread.py index 14fdc651323..902f37bbb28 100644 --- a/addons/mail/models/mail_thread.py +++ b/addons/mail/models/mail_thread.py @@ -229,7 +229,7 @@ class MailThread(models.AbstractModel): # automatic logging unless asked not to (mainly for various testing purpose) if not self._context.get('mail_create_nolog'): - doc_name = self.env['ir.model'].search([('model', '=', self._name)]).read(['name'])[0]['name'] + doc_name = self.env['ir.model']._get(self._name).name thread.message_post(body=_('%s created') % doc_name) # auto_subscribe: take values and defaults into account @@ -663,7 +663,7 @@ class MailThread(models.AbstractModel): access_link = self._notification_link_helper('view', message_id=message.id) if message.model: - model_name = self.env['ir.model'].sudo().search([('model', '=', self.env[message.model]._name)]).name_get()[0][1] + model_name = self.env['ir.model']._get(message.model).display_name view_title = '%s %s' % (_('View'), model_name) else: view_title = _('View') @@ -1133,7 +1133,7 @@ class MailThread(models.AbstractModel): dest_aliases = Alias.search([('alias_name', 'in', rcpt_tos_localparts)]) if dest_aliases: routes = [] - for alias in dest_aliases: + for alias in dest_aliases.sudo(): user_id = alias.alias_user_id.id if not user_id: # TDE note: this could cause crashes, because no clue that the user |