diff options
| author | Laurent Smet <las@openerp.com> | 2018-07-23 12:21:06 +0200 |
|---|---|---|
| committer | qdp-odoo <qdp@odoo.com> | 2018-07-23 12:21:06 +0200 |
| commit | 93cacd5e598ee5be8697301b1cf6fd7bf8b8e24c (patch) | |
| tree | fb399cdc6b625d5d96c4f51c036e6d81dd3fcda2 /addons/product/report | |
| parent | 6ea300498f78eaaee8c986e6302596448dc1339d (diff) | |
[FIX] account: improve security in reports and in account's query_get()
* privatize the get_report_values() method
* check read access rights and ir.rules in _query_get() from account module
Was task 36590
Was PR #25822
Diffstat (limited to 'addons/product/report')
| -rw-r--r-- | addons/product/report/product_pricelist.py | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/addons/product/report/product_pricelist.py b/addons/product/report/product_pricelist.py index 91f72d6cadd..1b5c56003cf 100644 --- a/addons/product/report/product_pricelist.py +++ b/addons/product/report/product_pricelist.py @@ -9,7 +9,7 @@ class report_product_pricelist(models.AbstractModel): _name = 'report.product.report_pricelist' @api.model - def get_report_values(self, docids, data=None): + def _get_report_values(self, docids, data=None): data = data if data is not None else {} pricelist = self.env['product.pricelist'].browse(data.get('form', {}).get('price_list', False)) products = self.env['product.product'].browse(data.get('ids', data.get('active_ids'))) |