From 5d746d0ac663232d656bb57e82fec290bb5d82fd Mon Sep 17 00:00:00 2001 From: Raphael Collet Date: Fri, 25 Nov 2016 10:01:14 +0100 Subject: [IMP] base, *: tighten `ir.model` access rights Remove unrestricted "read" access. To make code internally using `ir.model` work, add a private method `_get` on `ir.model` to retrieve the record corresponding to a model name, without access rights issue. Change signature of method `get_authorized_fields` to make it use a model name instead of a model id. This removes the necessity of a search on `ir.model`. --- addons/mail/wizard/mail_compose_message.py | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) (limited to 'addons/mail/wizard/mail_compose_message.py') diff --git a/addons/mail/wizard/mail_compose_message.py b/addons/mail/wizard/mail_compose_message.py index bc27da14e7c..35114a2542b 100644 --- a/addons/mail/wizard/mail_compose_message.py +++ b/addons/mail/wizard/mail_compose_message.py @@ -392,16 +392,14 @@ class MailComposer(models.TransientModel): """ hit save as template button: current form value will be a new template attached to the current document. """ for record in self: - models = self.env['ir.model'].search([('model', '=', record.model or 'mail.message')]) - model_name = '' - if models: - model_name = models.name + model = self.env['ir.model']._get(record.model or 'mail.message') + model_name = model.name or '' template_name = "%s: %s" % (model_name, tools.ustr(record.subject)) values = { 'name': template_name, 'subject': record.subject or False, 'body_html': record.body or False, - 'model_id': models.id or False, + 'model_id': model.id or False, 'attachment_ids': [(6, 0, [att.id for att in record.attachment_ids])], } template = self.env['mail.template'].create(values) -- cgit v1.2.3