Niels Huylebroeck has proposed merging 
lp:~openerp-community/openobject-server/fix-1094212-multicompany-res_partner 
into lp:openobject-server/7.0.

Requested reviews:
  OpenERP Core Team (openerp)
Related bugs:
  Bug #1094212 in OpenERP Server: "partner search & record rules & 
muliticompanies"
  https://bugs.launchpad.net/openobject-server/+bug/1094212

For more details, see:
https://code.launchpad.net/~openerp-community/openobject-server/fix-1094212-multicompany-res_partner/+merge/141936

The problem:

The result of cr.execute is bad (why hasn't everyone at openerp been 
brainwashed yet?) because it will contain results not appropriate for the 
current user (because of un-applied record rules)

The solution:

After we fetched the result cr.execute I now force the search to be executed 
(unconditionally) which is no problem even if "args" was not passed (see 
beginning of function where it is set to [] if it was None). Doing this search 
it will pass all the ids we have found so far but will also apply the required 
record rules, thus filtering out the unreadable partner ids in the process.

-- 
https://code.launchpad.net/~openerp-community/openobject-server/fix-1094212-multicompany-res_partner/+merge/141936
Your team OpenERP Community is subscribed to branch 
lp:~openerp-community/openobject-server/fix-1094212-multicompany-res_partner.
=== modified file 'openerp/addons/base/res/res_partner.py'
--- openerp/addons/base/res/res_partner.py	2012-12-21 12:06:31 +0000
+++ openerp/addons/base/res/res_partner.py	2013-01-04 15:27:25 +0000
@@ -463,8 +463,7 @@
                              OR partner.name || ' (' || COALESCE(company.name,'') || ')'
                           ''' + operator + ' %(name)s ' + limit_str, query_args)
             ids = map(lambda x: x[0], cr.fetchall())
-            if args:
-                ids = self.search(cr, uid, [('id', 'in', ids)] + args, limit=limit, context=context)
+            ids = self.search(cr, uid, [('id', 'in', ids)] + args, limit=limit, context=context)
             if ids:
                 return self.name_get(cr, uid, ids, context)
         return super(res_partner,self).name_search(cr, uid, name, args, operator=operator, context=context, limit=limit)

_______________________________________________
Mailing list: https://launchpad.net/~openerp-community
Post to     : [email protected]
Unsubscribe : https://launchpad.net/~openerp-community
More help   : https://help.launchpad.net/ListHelp

Reply via email to