Hello community, here is the log from the commit of package trytond for openSUSE:Factory checked in at 2018-12-08 11:21:11 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/trytond (Old) and /work/SRC/openSUSE:Factory/.trytond.new.19453 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "trytond" Sat Dec 8 11:21:11 2018 rev:25 rq:653620 version:4.2.16 Changes: -------- --- /work/SRC/openSUSE:Factory/trytond/trytond.changes 2018-09-10 12:32:17.574611554 +0200 +++ /work/SRC/openSUSE:Factory/.trytond.new.19453/trytond.changes 2018-12-08 11:21:21.098783045 +0100 @@ -1,0 +2,5 @@ +Tue Nov 13 15:13:58 UTC 2018 - Axel Braun <[email protected]> + +- Version 4.2.16 - Bugfix Release + +------------------------------------------------------------------- Old: ---- trytond-4.2.15.tar.gz New: ---- trytond-4.2.16.tar.gz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ trytond.spec ++++++ --- /var/tmp/diff_new_pack.zKhpAH/_old 2018-12-08 11:21:21.762782409 +0100 +++ /var/tmp/diff_new_pack.zKhpAH/_new 2018-12-08 11:21:21.762782409 +0100 @@ -13,14 +13,14 @@ # license that conforms to the Open Source Definition (Version 1.9) # published by the Open Source Initiative. -# Please submit bugfixes or comments via http://bugs.opensuse.org/ +# Please submit bugfixes or comments via https://bugs.opensuse.org/ # %define majorver 4.2 %define base_name tryton Name: trytond -Version: %{majorver}.15 +Version: %{majorver}.16 Release: 0 Summary: An Enterprise Resource Planning (ERP) system ++++++ trytond-4.2.15.tar.gz -> trytond-4.2.16.tar.gz ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/trytond-4.2.15/.hgtags new/trytond-4.2.16/.hgtags --- old/trytond-4.2.15/.hgtags 2018-08-20 23:00:12.000000000 +0200 +++ new/trytond-4.2.16/.hgtags 2018-11-12 23:24:08.000000000 +0100 @@ -30,3 +30,4 @@ 197e594bd737b72af1ea4ceb33d615d4eaadce9d 4.2.13 d06744ca57c2255f1c04e1e16e417c7dc2ce29e8 4.2.14 ab515936aa573baefddebf7f5d2a02591588fc00 4.2.15 +6a80c192098b2091ace6fe8f75ac9e26e7b49698 4.2.16 diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/trytond-4.2.15/CHANGELOG new/trytond-4.2.16/CHANGELOG --- old/trytond-4.2.15/CHANGELOG 2018-08-20 23:00:11.000000000 +0200 +++ new/trytond-4.2.16/CHANGELOG 2018-11-12 23:24:07.000000000 +0100 @@ -1,3 +1,7 @@ +Version 4.2.16 - 2018-11-12 +* Bug fixes (see mercurial logs for details) +* Check read access on field in search domain (issue7766) + Version 4.2.15 - 2018-08-20 * Bug fixes (see mercurial logs for details) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/trytond-4.2.15/PKG-INFO new/trytond-4.2.16/PKG-INFO --- old/trytond-4.2.15/PKG-INFO 2018-08-20 23:00:12.000000000 +0200 +++ new/trytond-4.2.16/PKG-INFO 2018-11-12 23:24:08.000000000 +0100 @@ -1,6 +1,6 @@ Metadata-Version: 1.1 Name: trytond -Version: 4.2.15 +Version: 4.2.16 Summary: Tryton server Home-page: http://www.tryton.org/ Author: Tryton diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/trytond-4.2.15/trytond/__init__.py new/trytond-4.2.16/trytond/__init__.py --- old/trytond-4.2.15/trytond/__init__.py 2018-08-20 23:00:00.000000000 +0200 +++ new/trytond-4.2.16/trytond/__init__.py 2018-08-20 23:00:41.000000000 +0200 @@ -5,7 +5,7 @@ import logging from email import charset -__version__ = "4.2.15" +__version__ = "4.2.16" logger = logging.getLogger(__name__) os.environ['TZ'] = 'UTC' diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/trytond-4.2.15/trytond/ir/ui/menu.py new/trytond-4.2.16/trytond/ir/ui/menu.py --- old/trytond-4.2.15/trytond/ir/ui/menu.py 2018-08-20 23:00:00.000000000 +0200 +++ new/trytond-4.2.16/trytond/ir/ui/menu.py 2018-11-03 01:25:56.000000000 +0100 @@ -185,8 +185,9 @@ parents.update(cls.search([ ('id', 'in', list(sub_parent_ids)), ])) - menus = [x for x in menus - if (x.parent and x.parent in parents) or not x.parent] + # Re-browse to avoid side-cache access + menus = cls.browse([x.id for x in menus + if (x.parent and x.parent in parents) or not x.parent]) if count: return len(menus) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/trytond-4.2.15/trytond/model/modelsql.py new/trytond-4.2.16/trytond/model/modelsql.py --- old/trytond-4.2.15/trytond/model/modelsql.py 2018-08-20 23:00:00.000000000 +0200 +++ new/trytond-4.2.16/trytond/model/modelsql.py 2018-11-12 18:01:25.000000000 +0100 @@ -14,7 +14,6 @@ from trytond.model import fields from trytond import backend from trytond.tools import reduce_ids, grouped_slice, cursor_dict -from trytond.const import OPERATORS from trytond.transaction import Transaction from trytond.pool import Pool from trytond.cache import LRUDict @@ -22,7 +21,7 @@ from trytond.rpc import RPC from trytond.config import config -from .modelstorage import cache_size +from .modelstorage import cache_size, is_leaf class Constraint(object): @@ -1116,6 +1115,9 @@ transaction = Transaction() cursor = transaction.connection.cursor() + super(ModelSQL, cls).search( + domain, offset=offset, limit=limit, order=order, count=count) + # Get domain clauses tables, expression = cls.search_domain(domain) @@ -1274,12 +1276,6 @@ else: tables[None] = (cls.__table__(), None) - def is_leaf(expression): - return (isinstance(expression, (list, tuple)) - and len(expression) > 2 - and isinstance(expression[1], basestring) - and expression[1] in OPERATORS) # TODO remove OPERATORS test - def convert(domain): if is_leaf(domain): fname = domain[0].split('.', 1)[0] diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/trytond-4.2.15/trytond/model/modelstorage.py new/trytond-4.2.16/trytond/model/modelstorage.py --- old/trytond-4.2.15/trytond/model/modelstorage.py 2018-08-20 23:00:00.000000000 +0200 +++ new/trytond-4.2.16/trytond/model/modelstorage.py 2018-11-12 18:01:25.000000000 +0100 @@ -43,6 +43,13 @@ config.getint('cache', 'record')) +def is_leaf(expression): + return (isinstance(expression, (list, tuple)) + and len(expression) > 2 + and isinstance(expression[1], basestring) + and expression[1] in OPERATORS) # TODO remove OPERATORS test + + class ModelStorage(Model): """ Define a model with storage capability in Tryton. @@ -183,6 +190,7 @@ cache[cls.__name__][record.id].clear() @classmethod + @without_check_access def trigger_write_get_eligibles(cls, records): ''' Return eligible records for write actions by triggers @@ -368,6 +376,36 @@ ''' Return a list of records that match the domain. ''' + pool = Pool() + transaction = Transaction() + ModelAccess = pool.get('ir.model.access') + ModelFieldAccess = pool.get('ir.model.field.access') + + ModelAccess.check(cls.__name__, 'read') + + def check(domain, cls, to_check): + if is_leaf(domain): + local, relate = (domain[0].split('.', 1) + [None])[:2] + to_check[cls.__name__].add(local) + if relate: + if len(domain) >= 4: + target = pool.get(domain[3]) + else: + target = cls._fields[local].get_target() + target_domain = [(relate,) + tuple(domain[1:])] + check(target_domain, target, to_check) + elif not domain: + return + else: + i = 1 if domain[0] in ['OR', 'AND'] else 0 + for d in domain[i:]: + check(d, cls, to_check) + if transaction.user and transaction.context.get('_check_access'): + to_check = defaultdict(set) + check(domain, cls, to_check) + for name, fields_names in to_check.items(): + ModelAccess.check(name, 'read') + ModelFieldAccess.check(name, fields_names, 'read') if count: return 0 return [] @@ -417,10 +455,7 @@ while i < len(domain): arg = domain[i] # add test for xmlrpc that doesn't handle tuple - if (isinstance(arg, tuple) - or (isinstance(arg, list) - and len(arg) > 2 - and arg[1] in OPERATORS)): + if is_leaf(arg): if arg[0] == 'active': active_found = True elif isinstance(arg, list): @@ -885,6 +920,7 @@ pass @classmethod + @without_check_access def _validate(cls, records, field_names=None): pool = Pool() # Ensure that records are readable diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/trytond-4.2.15/trytond.egg-info/PKG-INFO new/trytond-4.2.16/trytond.egg-info/PKG-INFO --- old/trytond-4.2.15/trytond.egg-info/PKG-INFO 2018-08-20 23:00:12.000000000 +0200 +++ new/trytond-4.2.16/trytond.egg-info/PKG-INFO 2018-11-12 23:24:08.000000000 +0100 @@ -1,6 +1,6 @@ Metadata-Version: 1.1 Name: trytond -Version: 4.2.15 +Version: 4.2.16 Summary: Tryton server Home-page: http://www.tryton.org/ Author: Tryton
