diff options
| author | Martin Trigaux <mat@odoo.com> | 2020-11-05 08:07:32 +0000 |
|---|---|---|
| committer | Martin Trigaux <mat@odoo.com> | 2020-11-10 10:47:14 +0000 |
| commit | a39e94f7e4dc74e850650ac90bbc5f85af130bc8 (patch) | |
| tree | bbe6160bc0b58db2bce6a4c5b13647dc16d3ef6e /addons/purchase_stock | |
| parent | 478ebc74554f6609a1414726ee1f35fe5dcd6a81 (diff) | |
[FIX] *: sanitize action content reading
The open_action_with_context was not using _for_xml_id, producing an
error when reading the action content.
In open_action, the action_name was taken from the context and needs
sanity checks. Ensure only actions from the account module can be
read and only if the user has access to the target model.
This is a limitation of the previous behaviour but, at the moment, all
known calls are made refering to an action from the account module.
Limit the scope of this method while the 14.0 is still early to avoid
having a door open to ready any action, and difficult to close later.
Remove old action fetching from the context in create_move that is no
longer used.
closes odoo/odoo#61365
Related: odoo/enterprise#14682
Signed-off-by: Martin Trigaux (mat) <mat@odoo.com>
Co-authored-by: Xavier Morel <xmo@odoo.com>
Diffstat (limited to 'addons/purchase_stock')
| -rw-r--r-- | addons/purchase_stock/models/stock.py | 3 |
1 files changed, 1 insertions, 2 deletions
diff --git a/addons/purchase_stock/models/stock.py b/addons/purchase_stock/models/stock.py index 526c96f124c..2aadedd4638 100644 --- a/addons/purchase_stock/models/stock.py +++ b/addons/purchase_stock/models/stock.py @@ -200,8 +200,7 @@ class Orderpoint(models.Model): """ This function returns an action that display existing purchase orders of given orderpoint. """ - action = self.env.ref('purchase.purchase_rfq') - result = action.read()[0] + result = self.env['ir.actions.act_window']._for_xml_id('purchase.purchase_rfq') # Remvove the context since the action basically display RFQ and not PO. result['context'] = {} |