From 2afb5b43ef0c7aa69b63145052a8d183d3d9d14b Mon Sep 17 00:00:00 2001
From: Xavier Morel <xmo@odoo.com>
Date: Wed, 25 Nov 2015 09:40:34 +0100
Subject: [IMP] form builder fields blacklisting

* blacklist all fields by default
* don't use blacklist in get_authorized_fields which is called to see if
  a field can be added to a form, instead only use it afterwards to see
  if the field can be written to by the formbuilder. That way
  formbuilder can whitelist fields which are actually added to forms
  on-demand resulting in a more secure interaction
---
 addons/website_issue/data/website_issue_data.xml | 5 -----
 1 file changed, 5 deletions(-)

(limited to 'addons/website_issue/data/website_issue_data.xml')

diff --git a/addons/website_issue/data/website_issue_data.xml b/addons/website_issue/data/website_issue_data.xml
index 8b043ee10e7..83f65b516e1 100644
--- a/addons/website_issue/data/website_issue_data.xml
+++ b/addons/website_issue/data/website_issue_data.xml
@@ -6,10 +6,5 @@
             <field name="website_form_access">True</field>
             <field name="website_form_label">Create an issue</field>
         </record>
-<!-- Template to blacklist field
-        <record id="project_issue.field_project_issue_{field_name}" model="ir.model.fields">
-            <field name="website_form_blacklisted">True</field>
-        </record>
--->
     </data>
 </openerp>
-- 
cgit v1.2.3