From 3d3ffc5c7c04594841141eb2fc7b6b09fe9d9117 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?C=C3=A9dric=20Krier?= Date: Sun, 17 Dec 2023 22:54:17 +0100 Subject: [PATCH] Do not check access when retrieving action ID The ID does not contain any security data. If the user does not have access to the action, an access error will be raised later when actual values are read. Closes #12803 --- trytond/trytond/ir/action.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/trytond/trytond/ir/action.py b/trytond/trytond/ir/action.py index 3d83cc976c..1e51dfb5f1 100644 --- a/trytond/trytond/ir/action.py +++ b/trytond/trytond/ir/action.py @@ -18,7 +18,8 @@ from trytond.pool import Pool from trytond.pyson import PYSON, Eval, PYSONDecoder, PYSONEncoder from trytond.rpc import RPC from trytond.tools import file_open -from trytond.transaction import Transaction, inactive_records +from trytond.transaction import ( + Transaction, inactive_records, without_check_access) if not config.get('html', 'plugins-ir.action.report-report_content_html'): config.set( @@ -99,6 +100,7 @@ class Action(DeactivableMixin, ModelSQL, ModelView): @classmethod @inactive_records + @without_check_access def get_action_id(cls, action_id): pool = Pool() if cls.search([