diff options
| author | Yannick Tivisse <yti@odoo.com> | 2016-09-07 11:06:02 +0200 |
|---|---|---|
| committer | Yannick Tivisse <yti@odoo.com> | 2016-09-07 11:22:50 +0200 |
| commit | 4910092d3e854390fa41d30444e7f165273c29a5 (patch) | |
| tree | b8b3a5d505645f6ebd9ba01e390dce0fdd537f1c /addons/website/static/src/xml/website.editor.xml | |
| parent | 97a4d4177680296119b06df07cac7e15123b56c1 (diff) | |
[FIX] report: Allow a portal user to print the 'external_layout_footer'
A user portal cannot have the read access right on the res partner, except his commercial_partner_id (his partner or the root partner if he got a parent company). That would a big security flaw.
In the header we use the contact widget to print the company information. This widget uses sudo to get all the required fields to display.
But in the footer, we still access some fields like company.fax which is not allowed.
As the contact widget uses sudo to display the company information in the header, we did the same here for the footer.
Diffstat (limited to 'addons/website/static/src/xml/website.editor.xml')
0 files changed, 0 insertions, 0 deletions