From a39e94f7e4dc74e850650ac90bbc5f85af130bc8 Mon Sep 17 00:00:00 2001 From: Martin Trigaux Date: Thu, 5 Nov 2020 08:07:32 +0000 Subject: [FIX] *: sanitize action content reading The open_action_with_context was not using _for_xml_id, producing an error when reading the action content. In open_action, the action_name was taken from the context and needs sanity checks. Ensure only actions from the account module can be read and only if the user has access to the target model. This is a limitation of the previous behaviour but, at the moment, all known calls are made refering to an action from the account module. Limit the scope of this method while the 14.0 is still early to avoid having a door open to ready any action, and difficult to close later. Remove old action fetching from the context in create_move that is no longer used. closes odoo/odoo#61365 Related: odoo/enterprise#14682 Signed-off-by: Martin Trigaux (mat) Co-authored-by: Xavier Morel --- odoo/tools/test_reports.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'odoo/tools') diff --git a/odoo/tools/test_reports.py b/odoo/tools/test_reports.py index 2ee6d16ae95..96d6b6fb89e 100644 --- a/odoo/tools/test_reports.py +++ b/odoo/tools/test_reports.py @@ -74,7 +74,7 @@ def try_report(cr, uid, rname, ids, data=None, context=None, our_module=None, re def try_report_action(cr, uid, action_id, active_model=None, active_ids=None, wiz_data=None, wiz_buttons=None, context=None, our_module=None): - """Take an ir.action.act_window and follow it until a report is produced + """Take an ir.actions.act_window and follow it until a report is produced :param action_id: the integer id of an action, or a reference to xml id of the act_window (can search [our_module.]+xml_id @@ -121,7 +121,7 @@ def try_report_action(cr, uid, action_id, active_model=None, active_ids=None, act_model, act_id = action._name, action.id else: assert isinstance(action_id, int) - act_model = 'ir.action.act_window' # assume that + act_model = 'ir.actions.act_window' # assume that act_id = action_id act_xmlid = '<%s>' % act_id -- cgit v1.2.3