diff options
| author | Raphael Collet <rco@openerp.com> | 2016-11-25 10:01:14 +0100 |
|---|---|---|
| committer | Raphael Collet <rco@openerp.com> | 2017-01-03 16:52:49 +0100 |
| commit | 5d746d0ac663232d656bb57e82fec290bb5d82fd (patch) | |
| tree | f1d51602745c28b43ab84a309fcbc7080c60e5c9 /addons/mail/wizard/invite.py | |
| parent | 1abd543f1412cf16953fd28659baabf1e4df6010 (diff) | |
[IMP] base, *: tighten `ir.model` access rights
Remove unrestricted "read" access. To make code internally using `ir.model`
work, add a private method `_get` on `ir.model` to retrieve the record
corresponding to a model name, without access rights issue.
Change signature of method `get_authorized_fields` to make it use a model name
instead of a model id. This removes the necessity of a search on `ir.model`.
Diffstat (limited to 'addons/mail/wizard/invite.py')
| -rw-r--r-- | addons/mail/wizard/invite.py | 5 |
1 files changed, 2 insertions, 3 deletions
diff --git a/addons/mail/wizard/invite.py b/addons/mail/wizard/invite.py index 1d345af517a..acb89641f75 100644 --- a/addons/mail/wizard/invite.py +++ b/addons/mail/wizard/invite.py @@ -18,7 +18,7 @@ class Invite(models.TransientModel): if self._context.get('mail_invite_follower_channel_only'): result['send_mail'] = False if 'message' in fields and model and res_id: - model_name = self.env['ir.model'].search([('model', '=', model)]).name_get()[0][1] + model_name = self.env['ir.model']._get(model).display_name document_name = self.env[model].browse(res_id).name_get()[0][1] message = _('<div><p>Hello,</p><p>%s invited you to follow %s document: %s.</p></div>') % (user_name, model_name, document_name) result['message'] = message @@ -46,8 +46,7 @@ class Invite(models.TransientModel): new_channels = wizard.channel_ids - document.message_channel_ids document.message_subscribe(new_partners.ids, new_channels.ids) - model_ids = self.env['ir.model'].search([('model', '=', wizard.res_model)]) - model_name = model_ids.name_get()[0][1] + model_name = self.env['ir.model']._get(wizard.res_model).display_name # send an email if option checked and if a message exists (do not send void emails) if wizard.send_mail and wizard.message and not wizard.message == '<br>': # when deleting the message, cleditor keeps a <br> message = self.env['mail.message'].create({ |