Hello community,

here is the log from the commit of package trytond for openSUSE:Factory checked 
in at 2018-12-08 11:21:11
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/trytond (Old)
 and      /work/SRC/openSUSE:Factory/.trytond.new.19453 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Package is "trytond"

Sat Dec  8 11:21:11 2018 rev:25 rq:653620 version:4.2.16

Changes:
--------
--- /work/SRC/openSUSE:Factory/trytond/trytond.changes  2018-09-10 
12:32:17.574611554 +0200
+++ /work/SRC/openSUSE:Factory/.trytond.new.19453/trytond.changes       
2018-12-08 11:21:21.098783045 +0100
@@ -1,0 +2,5 @@
+Tue Nov 13 15:13:58 UTC 2018 - Axel Braun <[email protected]>
+
+- Version 4.2.16 - Bugfix Release
+
+-------------------------------------------------------------------

Old:
----
  trytond-4.2.15.tar.gz

New:
----
  trytond-4.2.16.tar.gz

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Other differences:
------------------
++++++ trytond.spec ++++++
--- /var/tmp/diff_new_pack.zKhpAH/_old  2018-12-08 11:21:21.762782409 +0100
+++ /var/tmp/diff_new_pack.zKhpAH/_new  2018-12-08 11:21:21.762782409 +0100
@@ -13,14 +13,14 @@
 # license that conforms to the Open Source Definition (Version 1.9)
 # published by the Open Source Initiative.
 
-# Please submit bugfixes or comments via http://bugs.opensuse.org/
+# Please submit bugfixes or comments via https://bugs.opensuse.org/
 #
 
 
 %define majorver 4.2
 %define base_name tryton
 Name:           trytond
-Version:        %{majorver}.15
+Version:        %{majorver}.16
 Release:        0
 
 Summary:        An Enterprise Resource Planning (ERP) system

++++++ trytond-4.2.15.tar.gz -> trytond-4.2.16.tar.gz ++++++
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/trytond-4.2.15/.hgtags new/trytond-4.2.16/.hgtags
--- old/trytond-4.2.15/.hgtags  2018-08-20 23:00:12.000000000 +0200
+++ new/trytond-4.2.16/.hgtags  2018-11-12 23:24:08.000000000 +0100
@@ -30,3 +30,4 @@
 197e594bd737b72af1ea4ceb33d615d4eaadce9d 4.2.13
 d06744ca57c2255f1c04e1e16e417c7dc2ce29e8 4.2.14
 ab515936aa573baefddebf7f5d2a02591588fc00 4.2.15
+6a80c192098b2091ace6fe8f75ac9e26e7b49698 4.2.16
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/trytond-4.2.15/CHANGELOG new/trytond-4.2.16/CHANGELOG
--- old/trytond-4.2.15/CHANGELOG        2018-08-20 23:00:11.000000000 +0200
+++ new/trytond-4.2.16/CHANGELOG        2018-11-12 23:24:07.000000000 +0100
@@ -1,3 +1,7 @@
+Version 4.2.16 - 2018-11-12
+* Bug fixes (see mercurial logs for details)
+* Check read access on field in search domain (issue7766)
+
 Version 4.2.15 - 2018-08-20
 * Bug fixes (see mercurial logs for details)
 
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/trytond-4.2.15/PKG-INFO new/trytond-4.2.16/PKG-INFO
--- old/trytond-4.2.15/PKG-INFO 2018-08-20 23:00:12.000000000 +0200
+++ new/trytond-4.2.16/PKG-INFO 2018-11-12 23:24:08.000000000 +0100
@@ -1,6 +1,6 @@
 Metadata-Version: 1.1
 Name: trytond
-Version: 4.2.15
+Version: 4.2.16
 Summary: Tryton server
 Home-page: http://www.tryton.org/
 Author: Tryton
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/trytond-4.2.15/trytond/__init__.py 
new/trytond-4.2.16/trytond/__init__.py
--- old/trytond-4.2.15/trytond/__init__.py      2018-08-20 23:00:00.000000000 
+0200
+++ new/trytond-4.2.16/trytond/__init__.py      2018-08-20 23:00:41.000000000 
+0200
@@ -5,7 +5,7 @@
 import logging
 from email import charset
 
-__version__ = "4.2.15"
+__version__ = "4.2.16"
 logger = logging.getLogger(__name__)
 
 os.environ['TZ'] = 'UTC'
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/trytond-4.2.15/trytond/ir/ui/menu.py 
new/trytond-4.2.16/trytond/ir/ui/menu.py
--- old/trytond-4.2.15/trytond/ir/ui/menu.py    2018-08-20 23:00:00.000000000 
+0200
+++ new/trytond-4.2.16/trytond/ir/ui/menu.py    2018-11-03 01:25:56.000000000 
+0100
@@ -185,8 +185,9 @@
                 parents.update(cls.search([
                             ('id', 'in', list(sub_parent_ids)),
                             ]))
-            menus = [x for x in menus
-                if (x.parent and x.parent in parents) or not x.parent]
+            # Re-browse to avoid side-cache access
+            menus = cls.browse([x.id for x in menus
+                    if (x.parent and x.parent in parents) or not x.parent])
 
         if count:
             return len(menus)
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/trytond-4.2.15/trytond/model/modelsql.py 
new/trytond-4.2.16/trytond/model/modelsql.py
--- old/trytond-4.2.15/trytond/model/modelsql.py        2018-08-20 
23:00:00.000000000 +0200
+++ new/trytond-4.2.16/trytond/model/modelsql.py        2018-11-12 
18:01:25.000000000 +0100
@@ -14,7 +14,6 @@
 from trytond.model import fields
 from trytond import backend
 from trytond.tools import reduce_ids, grouped_slice, cursor_dict
-from trytond.const import OPERATORS
 from trytond.transaction import Transaction
 from trytond.pool import Pool
 from trytond.cache import LRUDict
@@ -22,7 +21,7 @@
 from trytond.rpc import RPC
 from trytond.config import config
 
-from .modelstorage import cache_size
+from .modelstorage import cache_size, is_leaf
 
 
 class Constraint(object):
@@ -1116,6 +1115,9 @@
         transaction = Transaction()
         cursor = transaction.connection.cursor()
 
+        super(ModelSQL, cls).search(
+            domain, offset=offset, limit=limit, order=order, count=count)
+
         # Get domain clauses
         tables, expression = cls.search_domain(domain)
 
@@ -1274,12 +1276,6 @@
             else:
                 tables[None] = (cls.__table__(), None)
 
-        def is_leaf(expression):
-            return (isinstance(expression, (list, tuple))
-                and len(expression) > 2
-                and isinstance(expression[1], basestring)
-                and expression[1] in OPERATORS)  # TODO remove OPERATORS test
-
         def convert(domain):
             if is_leaf(domain):
                 fname = domain[0].split('.', 1)[0]
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/trytond-4.2.15/trytond/model/modelstorage.py 
new/trytond-4.2.16/trytond/model/modelstorage.py
--- old/trytond-4.2.15/trytond/model/modelstorage.py    2018-08-20 
23:00:00.000000000 +0200
+++ new/trytond-4.2.16/trytond/model/modelstorage.py    2018-11-12 
18:01:25.000000000 +0100
@@ -43,6 +43,13 @@
         config.getint('cache', 'record'))
 
 
+def is_leaf(expression):
+    return (isinstance(expression, (list, tuple))
+        and len(expression) > 2
+        and isinstance(expression[1], basestring)
+        and expression[1] in OPERATORS)  # TODO remove OPERATORS test
+
+
 class ModelStorage(Model):
     """
     Define a model with storage capability in Tryton.
@@ -183,6 +190,7 @@
                         cache[cls.__name__][record.id].clear()
 
     @classmethod
+    @without_check_access
     def trigger_write_get_eligibles(cls, records):
         '''
         Return eligible records for write actions by triggers
@@ -368,6 +376,36 @@
         '''
         Return a list of records that match the domain.
         '''
+        pool = Pool()
+        transaction = Transaction()
+        ModelAccess = pool.get('ir.model.access')
+        ModelFieldAccess = pool.get('ir.model.field.access')
+
+        ModelAccess.check(cls.__name__, 'read')
+
+        def check(domain, cls, to_check):
+            if is_leaf(domain):
+                local, relate = (domain[0].split('.', 1) + [None])[:2]
+                to_check[cls.__name__].add(local)
+                if relate:
+                    if len(domain) >= 4:
+                        target = pool.get(domain[3])
+                    else:
+                        target = cls._fields[local].get_target()
+                    target_domain = [(relate,) + tuple(domain[1:])]
+                    check(target_domain, target, to_check)
+            elif not domain:
+                return
+            else:
+                i = 1 if domain[0] in ['OR', 'AND'] else 0
+                for d in domain[i:]:
+                    check(d, cls, to_check)
+        if transaction.user and transaction.context.get('_check_access'):
+            to_check = defaultdict(set)
+            check(domain, cls, to_check)
+            for name, fields_names in to_check.items():
+                ModelAccess.check(name, 'read')
+                ModelFieldAccess.check(name, fields_names, 'read')
         if count:
             return 0
         return []
@@ -417,10 +455,7 @@
             while i < len(domain):
                 arg = domain[i]
                 # add test for xmlrpc that doesn't handle tuple
-                if (isinstance(arg, tuple)
-                        or (isinstance(arg, list)
-                            and len(arg) > 2
-                            and arg[1] in OPERATORS)):
+                if is_leaf(arg):
                     if arg[0] == 'active':
                         active_found = True
                 elif isinstance(arg, list):
@@ -885,6 +920,7 @@
         pass
 
     @classmethod
+    @without_check_access
     def _validate(cls, records, field_names=None):
         pool = Pool()
         # Ensure that records are readable
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/trytond-4.2.15/trytond.egg-info/PKG-INFO 
new/trytond-4.2.16/trytond.egg-info/PKG-INFO
--- old/trytond-4.2.15/trytond.egg-info/PKG-INFO        2018-08-20 
23:00:12.000000000 +0200
+++ new/trytond-4.2.16/trytond.egg-info/PKG-INFO        2018-11-12 
23:24:08.000000000 +0100
@@ -1,6 +1,6 @@
 Metadata-Version: 1.1
 Name: trytond
-Version: 4.2.15
+Version: 4.2.16
 Summary: Tryton server
 Home-page: http://www.tryton.org/
 Author: Tryton


Reply via email to