diff options
| author | Martin Trigaux <mat@odoo.com> | 2020-09-01 12:27:32 +0000 |
|---|---|---|
| committer | Martin Trigaux <mat@odoo.com> | 2020-09-04 09:45:10 +0000 |
| commit | efc0263b2574fa355ea794514eb3285d8c449260 (patch) | |
| tree | c4ac81d0f9f317509b71782b5e86d08f17be57a8 /addons/web/models | |
| parent | 4d43a301fd10cfeb498d9bf6b614779e26e12d16 (diff) | |
[IMP] base: implement comment
Forgotten TODO
Instead of checking in _for_xml_id (where 99% of calls are static),
verify on the few calls that accept an arbitrary argument
closes odoo/odoo#56876
Related: odoo/enterprise#12844
Signed-off-by: Martin Trigaux (mat) <mat@odoo.com>
Diffstat (limited to 'addons/web/models')
| -rw-r--r-- | addons/web/models/base_document_layout.py | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/addons/web/models/base_document_layout.py b/addons/web/models/base_document_layout.py index 47ccd2114e9..8d26f61e2f7 100644 --- a/addons/web/models/base_document_layout.py +++ b/addons/web/models/base_document_layout.py @@ -216,7 +216,9 @@ class BaseDocumentLayout(models.TransientModel): def action_open_base_document_layout(self, action_ref=None): if not action_ref: action_ref = 'web.action_base_document_layout_configurator' - return self.env["ir.actions.actions"]._for_xml_id(action_ref) + res = self.env["ir.actions.actions"]._for_xml_id(action_ref) + self.env[res["res_model"]].check_access_rights('write') + return res def document_layout_save(self): # meant to be overridden |