diff options
| author | Martin Trigaux <mat@odoo.com> | 2020-11-05 08:07:32 +0000 |
|---|---|---|
| committer | Martin Trigaux <mat@odoo.com> | 2020-11-10 10:47:14 +0000 |
| commit | a39e94f7e4dc74e850650ac90bbc5f85af130bc8 (patch) | |
| tree | bbe6160bc0b58db2bce6a4c5b13647dc16d3ef6e /odoo/tools/test_reports.py | |
| parent | 478ebc74554f6609a1414726ee1f35fe5dcd6a81 (diff) | |
[FIX] *: sanitize action content reading
The open_action_with_context was not using _for_xml_id, producing an
error when reading the action content.
In open_action, the action_name was taken from the context and needs
sanity checks. Ensure only actions from the account module can be
read and only if the user has access to the target model.
This is a limitation of the previous behaviour but, at the moment, all
known calls are made refering to an action from the account module.
Limit the scope of this method while the 14.0 is still early to avoid
having a door open to ready any action, and difficult to close later.
Remove old action fetching from the context in create_move that is no
longer used.
closes odoo/odoo#61365
Related: odoo/enterprise#14682
Signed-off-by: Martin Trigaux (mat) <mat@odoo.com>
Co-authored-by: Xavier Morel <xmo@odoo.com>
Diffstat (limited to 'odoo/tools/test_reports.py')
| -rw-r--r-- | odoo/tools/test_reports.py | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/odoo/tools/test_reports.py b/odoo/tools/test_reports.py index 2ee6d16ae95..96d6b6fb89e 100644 --- a/odoo/tools/test_reports.py +++ b/odoo/tools/test_reports.py @@ -74,7 +74,7 @@ def try_report(cr, uid, rname, ids, data=None, context=None, our_module=None, re def try_report_action(cr, uid, action_id, active_model=None, active_ids=None, wiz_data=None, wiz_buttons=None, context=None, our_module=None): - """Take an ir.action.act_window and follow it until a report is produced + """Take an ir.actions.act_window and follow it until a report is produced :param action_id: the integer id of an action, or a reference to xml id of the act_window (can search [our_module.]+xml_id @@ -121,7 +121,7 @@ def try_report_action(cr, uid, action_id, active_model=None, active_ids=None, act_model, act_id = action._name, action.id else: assert isinstance(action_id, int) - act_model = 'ir.action.act_window' # assume that + act_model = 'ir.actions.act_window' # assume that act_id = action_id act_xmlid = '<%s>' % act_id |