diff options
| author | Olivier Dony <odo@openerp.com> | 2011-01-27 16:45:32 +0100 |
|---|---|---|
| committer | Olivier Dony <odo@openerp.com> | 2011-01-27 16:45:32 +0100 |
| commit | 79cd0848c13133308ddb62b718844ce2b5131d9e (patch) | |
| tree | 4b13edd8cec21b57c2f2d829820bf4b932685870 /bin | |
| parent | ce4675876fd7a79c63312fe7f98889336c0f72e4 (diff) | |
[FIX] ir_attachment: typo introduced in previous fix (3318)
Original revision: 3318 - nel@tinyerp.com-20110121084241-10kfmgd16vt19vkv
The consequence is that access rights on attachments would be incorrectly checked, using the
intersection of the attachment IDs and the resource IDs.
bzr revid: odo@openerp.com-20110127154532-v18l28qk8ysi02sb
Diffstat (limited to 'bin')
| -rw-r--r-- | bin/addons/base/ir/ir_attachment.py | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/bin/addons/base/ir/ir_attachment.py b/bin/addons/base/ir/ir_attachment.py index 74502d374d2..480d6782912 100644 --- a/bin/addons/base/ir/ir_attachment.py +++ b/bin/addons/base/ir/ir_attachment.py @@ -44,10 +44,13 @@ class ir_attachment(osv.osv): if values: if 'res_model' in values and 'res_id' in values: res_ids.setdefault(values['res_model'],[]).append(values['res_id']) - + for model, mids in res_ids.items(): - cr.execute('select id from '+self.pool.get(model)._table+' where id in %s', (tuple(ids),)) + # ignore attachments that are not attached to a resource anymore when checking access rights + # (resource was deleted but attachment was not) + cr.execute('select id from '+self.pool.get(model)._table+' where id in %s', (tuple(mids),)) mids = [x[0] for x in cr.fetchall()] + self.pool.get(model).check_access_rule(cr, uid, mids, mode, context=context) def search(self, cr, uid, args, offset=0, limit=None, order=None, |