[tryton-commits] [tryton] [7.8] Enforce access right on the email template record

[Cédric Krier]

details:   https://code.tryton.org/tryton/commit/33fd88f82c04
branch:    7.8
user:      Cédric Krier <c...@b2ck.com>
date:      Tue Jun 30 09:48:33 2026 +0200
description:
        Enforce access right on the email template record

        Closes #14907
        (grafted from d9aa2de5dabe7e39892c41808d56103ea83bf95f)
diffstat:

 trytond/CHANGELOG            |  1 +
 trytond/trytond/ir/email_.py |  5 +++--
 2 files changed, 4 insertions(+), 2 deletions(-)

diffs (30 lines):

diff -r ca2154d75637 -r 33fd88f82c04 trytond/CHANGELOG
--- a/trytond/CHANGELOG Tue Jun 30 23:04:09 2026 +0200
+++ b/trytond/CHANGELOG Tue Jun 30 09:48:33 2026 +0200
@@ -1,3 +1,4 @@
+* Enforce access right on the email template record (issue14907)
 * Add ModelAccessProxy (issue14907)
 * Restrict Genshi evaluation (issue14869, issue5160)
 
diff -r ca2154d75637 -r 33fd88f82c04 trytond/trytond/ir/email_.py
--- a/trytond/trytond/ir/email_.py      Tue Jun 30 23:04:09 2026 +0200
+++ b/trytond/trytond/ir/email_.py      Tue Jun 30 09:48:33 2026 +0200
@@ -14,7 +14,8 @@
 
 import trytond.config as config
 from trytond.i18n import gettext
-from trytond.model import EvalEnvironment, ModelSQL, ModelView, fields
+from trytond.model import (
+    EvalEnvironment, ModelAccessProxy, ModelSQL, ModelView, fields)
 from trytond.model.exceptions import AccessError, ValidationError
 from trytond.pool import Pool
 from trytond.pyson import Bool, Eval, PYSONDecoder
@@ -406,7 +407,7 @@
     def get(self, record):
         pool = Pool()
         Model = pool.get(self.model.name)
-        record = Model(int(record))
+        record = ModelAccessProxy(Model(int(record)))
 
         values = {}
         for attr, key in [