changeset 66c57ea029d2 in trytond:default
details: https://hg.tryton.org/trytond?cmd=changeset&node=66c57ea029d2
description:
Prevent to create and delete singleton
issue1639
review378481002
diffstat:
CHANGELOG | 1 +
trytond/ir/model.py | 11 ++++++++---
trytond/model/modelsingleton.py | 3 ++-
3 files changed, 11 insertions(+), 4 deletions(-)
diffs (49 lines):
diff -r 33738efe709c -r 66c57ea029d2 CHANGELOG
--- a/CHANGELOG Sat Mar 26 12:00:33 2022 +0100
+++ b/CHANGELOG Sat Mar 26 13:03:39 2022 +0100
@@ -1,3 +1,4 @@
+* Prevent to create and delete singleton
* Allow CORS on root path
* Allow button access to be deactivated
* Always return tuple for MultiSelection
diff -r 33738efe709c -r 66c57ea029d2 trytond/ir/model.py
--- a/trytond/ir/model.py Sat Mar 26 12:00:33 2022 +0100
+++ b/trytond/ir/model.py Sat Mar 26 13:03:39 2022 +0100
@@ -15,8 +15,8 @@
from trytond.cache import Cache
from trytond.i18n import gettext
from trytond.model import (
- DeactivableMixin, EvalEnvironment, Exclude, ModelSQL, ModelView, Unique,
- Workflow, fields)
+ DeactivableMixin, EvalEnvironment, Exclude, ModelSingleton, ModelSQL,
+ ModelView, Unique, Workflow, fields)
from trytond.model.exceptions import AccessError, ValidationError
from trytond.pool import Pool
from trytond.protocols.jsonrpc import JSONDecoder, JSONEncoder
@@ -549,7 +549,12 @@
all_models = list(set(sum(model2models.values(), [])))
default = {'read': True, 'write': True, 'create': True, 'delete': True}
- access = dict((m, default) for m in models)
+ default_singleton = {
+ 'read': True, 'write': True, 'create': False, 'delete': False}
+ access = {
+ m: default
+ if not issubclass(pool.get(m), ModelSingleton)
+ else default_singleton for m in models}
cursor.execute(*model_access.join(ir_model, 'LEFT',
condition=model_access.model == ir_model.id
).join(user_group, 'LEFT',
diff -r 33738efe709c -r 66c57ea029d2 trytond/model/modelsingleton.py
--- a/trytond/model/modelsingleton.py Sat Mar 26 12:00:33 2022 +0100
+++ b/trytond/model/modelsingleton.py Sat Mar 26 13:03:39 2022 +0100
@@ -58,7 +58,8 @@
def write(cls, records, values, *args):
singleton = cls.get_singleton()
if not singleton:
- singleton, = cls.create([values])
+ with Transaction().set_context(_check_access=False):
+ singleton, = cls.create([values])
actions = (records, values) + args
args = []
for values in actions[1:None:2]:
