diff options
| author | Xavier Morel <xmo@odoo.com> | 2015-11-25 09:40:34 +0100 |
|---|---|---|
| committer | Christophe Simonis <chs@odoo.com> | 2015-11-30 16:39:13 +0100 |
| commit | 2afb5b43ef0c7aa69b63145052a8d183d3d9d14b (patch) | |
| tree | 106228e7191b04819576cf070b450d27d7bc2f61 /addons/website_crm/data/website_crm_data.xml | |
| parent | 2769029eefd9456259c664ea846156fc9bd26a91 (diff) | |
[IMP] form builder fields blacklisting
* blacklist all fields by default
* don't use blacklist in get_authorized_fields which is called to see if
a field can be added to a form, instead only use it afterwards to see
if the field can be written to by the formbuilder. That way
formbuilder can whitelist fields which are actually added to forms
on-demand resulting in a more secure interaction
Diffstat (limited to 'addons/website_crm/data/website_crm_data.xml')
| -rw-r--r-- | addons/website_crm/data/website_crm_data.xml | 11 |
1 files changed, 11 insertions, 0 deletions
diff --git a/addons/website_crm/data/website_crm_data.xml b/addons/website_crm/data/website_crm_data.xml index c61746b2ad7..5c454fc942c 100644 --- a/addons/website_crm/data/website_crm_data.xml +++ b/addons/website_crm/data/website_crm_data.xml @@ -6,6 +6,17 @@ <field name="website_form_access">True</field> <field name="website_form_label">Create a lead</field> </record> + <function model="ir.model.fields" name="formbuilder_whitelist"> + <value>crm.lead</value> + <value eval="[ + 'contact_name', + 'description', + 'email_from', + 'name', + 'partner_name', + 'phone', + ]"/> + </function> </data> <data noupdate="1"> <record id="action_open_website" model="ir.actions.act_url"> |