diff options
| author | Xavier Morel <xmo@odoo.com> | 2015-11-25 09:40:34 +0100 |
|---|---|---|
| committer | Christophe Simonis <chs@odoo.com> | 2015-11-30 16:39:13 +0100 |
| commit | 2afb5b43ef0c7aa69b63145052a8d183d3d9d14b (patch) | |
| tree | 106228e7191b04819576cf070b450d27d7bc2f61 /addons/website_hr_recruitment/data/config_data.xml | |
| parent | 2769029eefd9456259c664ea846156fc9bd26a91 (diff) | |
[IMP] form builder fields blacklisting
* blacklist all fields by default
* don't use blacklist in get_authorized_fields which is called to see if
a field can be added to a form, instead only use it afterwards to see
if the field can be written to by the formbuilder. That way
formbuilder can whitelist fields which are actually added to forms
on-demand resulting in a more secure interaction
Diffstat (limited to 'addons/website_hr_recruitment/data/config_data.xml')
| -rw-r--r-- | addons/website_hr_recruitment/data/config_data.xml | 11 |
1 files changed, 11 insertions, 0 deletions
diff --git a/addons/website_hr_recruitment/data/config_data.xml b/addons/website_hr_recruitment/data/config_data.xml index e61fb99c41f..24e4ed8b30f 100644 --- a/addons/website_hr_recruitment/data/config_data.xml +++ b/addons/website_hr_recruitment/data/config_data.xml @@ -23,5 +23,16 @@ <field name="website_form_access">True</field> <field name="website_form_label">Apply for a Job</field> </record> + <function model="ir.model.fields" name="formbuilder_whitelist"> + <value>hr.applicant</value> + <value eval="[ + 'description', + 'email_from', + 'partner_name', + 'partner_phone', + 'job_id', + 'department_id', + ]"/> + </function> </data> </openerp> |