From 2afb5b43ef0c7aa69b63145052a8d183d3d9d14b Mon Sep 17 00:00:00 2001
From: Xavier Morel <xmo@odoo.com>
Date: Wed, 25 Nov 2015 09:40:34 +0100
Subject: [IMP] form builder fields blacklisting

* blacklist all fields by default
* don't use blacklist in get_authorized_fields which is called to see if
  a field can be added to a form, instead only use it afterwards to see
  if the field can be written to by the formbuilder. That way
  formbuilder can whitelist fields which are actually added to forms
  on-demand resulting in a more secure interaction
---
 addons/website_hr_recruitment/data/config_data.xml | 11 +++++++++++
 1 file changed, 11 insertions(+)

(limited to 'addons/website_hr_recruitment/data')

diff --git a/addons/website_hr_recruitment/data/config_data.xml b/addons/website_hr_recruitment/data/config_data.xml
index e61fb99c41f..24e4ed8b30f 100644
--- a/addons/website_hr_recruitment/data/config_data.xml
+++ b/addons/website_hr_recruitment/data/config_data.xml
@@ -23,5 +23,16 @@
             <field name="website_form_access">True</field>
             <field name="website_form_label">Apply for a Job</field>
         </record>
+        <function model="ir.model.fields" name="formbuilder_whitelist">
+            <value>hr.applicant</value>
+            <value eval="[
+                'description',
+                'email_from',
+                'partner_name',
+                'partner_phone',
+                'job_id',
+                'department_id',
+            ]"/>
+        </function>
     </data>
 </openerp>
-- 
cgit v1.2.3