[tryton-commits] [tryton] [default] Enforce access right on the email template re...

[Cédric Krier]

details:   https://code.tryton.org/tryton/commit/d9aa2de5dabe
branch:    default
user:      Cédric Krier <c...@b2ck.com>
date:      Tue Jun 30 09:48:33 2026 +0200
description:
        Enforce access right on the email template record

        Closes #14907
diffstat:

 trytond/CHANGELOG            |  1 +
 trytond/trytond/ir/email_.py |  5 +++--
 2 files changed, 4 insertions(+), 2 deletions(-)

diffs (30 lines):

diff -r dafef28a1d65 -r d9aa2de5dabe trytond/CHANGELOG
--- a/trytond/CHANGELOG Thu Jun 25 13:31:30 2026 +0200
+++ b/trytond/CHANGELOG Tue Jun 30 09:48:33 2026 +0200
@@ -1,3 +1,4 @@
+* Enforce access right on the email template record (issue14907)
 * Add ModelAccessProxy (issue14907)
 * Restrict Genshi evaluation (issue14869, issue5160)
 * Add BrowseList for Model instances
diff -r dafef28a1d65 -r d9aa2de5dabe trytond/trytond/ir/email_.py
--- a/trytond/trytond/ir/email_.py      Thu Jun 25 13:31:30 2026 +0200
+++ b/trytond/trytond/ir/email_.py      Tue Jun 30 09:48:33 2026 +0200
@@ -10,7 +10,8 @@
 
 import trytond.config as config
 from trytond.i18n import gettext
-from trytond.model import EvalEnvironment, ModelSQL, ModelView, fields
+from trytond.model import (
+    EvalEnvironment, ModelAccessProxy, ModelSQL, ModelView, fields)
 from trytond.model.exceptions import AccessError, ValidationError
 from trytond.pool import Pool
 from trytond.pyson import Bool, Eval, PYSONDecoder
@@ -400,7 +401,7 @@
     def get(self, record):
         pool = Pool()
         Model = pool.get(self.model.name)
-        record = Model(int(record))
+        record = ModelAccessProxy(Model(int(record)))
 
         values = {}
         for attr, key in [