changeset 107af2fc2ef8 in trytond:default
details: https://hg.tryton.org/trytond?cmd=changeset;node=107af2fc2ef8
description:
Check record rule in button decorator
In order to relax internal control of record rules, they must be
enforced on
the button entry point.
This is done by just reading the id of the records already stored.
issue7638
review349381002
diffstat:
trytond/model/modelstorage.py | 2 +-
trytond/model/modelview.py | 6 ++++++
2 files changed, 7 insertions(+), 1 deletions(-)
diffs (42 lines):
diff -r bdbd86d9c69a -r 107af2fc2ef8 trytond/model/modelstorage.py
--- a/trytond/model/modelstorage.py Sun Feb 14 14:28:55 2021 +0100
+++ b/trytond/model/modelstorage.py Sun Feb 14 15:47:00 2021 +0100
@@ -25,7 +25,6 @@
from trytond.pool import Pool
from trytond.cache import LRUDict, LRUDictTransaction, freeze
from trytond.rpc import RPC
-from .modelview import ModelView
from .descriptors import dualmethod
__all__ = ['ModelStorage', 'EvalEnvironment']
@@ -121,6 +120,7 @@
@classmethod
def __setup__(cls):
+ from .modelview import ModelView
super(ModelStorage, cls).__setup__()
if issubclass(cls, ModelView):
cls.__rpc__.update({
diff -r bdbd86d9c69a -r 107af2fc2ef8 trytond/model/modelview.py
--- a/trytond/model/modelview.py Sun Feb 14 14:28:55 2021 +0100
+++ b/trytond/model/modelview.py Sun Feb 14 15:47:00 2021 +0100
@@ -719,6 +719,7 @@
def button(func):
@wraps(func)
def wrapper(cls, records, *args, **kwargs):
+ from .modelstorage import ModelStorage
pool = Pool()
ModelAccess = pool.get('ir.model.access')
Button = pool.get('ir.model.button')
@@ -732,6 +733,11 @@
if (transaction.user != 0) and check_access:
ModelAccess.check(cls.__name__, 'read')
+ if issubclass(cls, ModelStorage):
+ # Check record rule access
+ cls.read([r.id for r in records
+ if r.id is not None and r.id >= 0],
+ ['id'])
groups = set(User.get_groups())
button_groups = Button.get_groups(cls.__name__,
func.__name__)
