changeset f78cf720e676 in trytond:5.0
details: https://hg.tryton.org/trytond?cmd=changeset;node=f78cf720e676
description:
Check model read access only on wizard with table_query models
issue9251
review297631002
(grafted from ce5ad8f394402a99bc7d96a594317e849257d34f)
diffstat:
trytond/wizard/wizard.py | 6 +++++-
1 files changed, 5 insertions(+), 1 deletions(-)
diffs (23 lines):
diff -r c8395b802540 -r f78cf720e676 trytond/wizard/wizard.py
--- a/trytond/wizard/wizard.py Tue Apr 21 14:06:10 2020 +0200
+++ b/trytond/wizard/wizard.py Sat Apr 25 08:50:14 2020 +0200
@@ -13,6 +13,7 @@
from trytond.error import WarningErrorMixin
from trytond.url import URLMixin
from trytond.protocols.jsonrpc import JSONDecoder, JSONEncoder
+from trytond.model import ModelSQL
from trytond.model.fields import states_validate
from trytond.pyson import PYSONEncoder
from trytond.rpc import RPC
@@ -239,7 +240,10 @@
raise UserError('Calling wizard %s is not allowed!'
% cls.__name__)
elif model and model != 'ir.ui.menu':
- ModelAccess.check(model, 'write')
+ Model = pool.get(model)
+ if (not callable(getattr(Model, 'table_query', None))
+ or Model.write.__func__ != ModelSQL.write.__func__):
+ ModelAccess.check(model, 'write')
@classmethod
def create(cls):
