Fix search button clause in ModelButton.get_groups

CVE-2012-2238
issue2757
review478002

CHANGELOG

@@ -1,3 +1,4 @@
+* Fix search button clause in ModelButton.get_groups (CVE-2012-2238)
 * Merge all kind of buttons
 * Use XML id for board action instead of id
 * Add states attribute to notebook

trytond/ir/model.py

@@ -555,7 +555,7 @@ class ModelButton(ModelSQL, ModelView):
         Return a set of group ids for the named button on the model.
         '''
         button_ids = self.search([
-                ('model', '=', model),
+                ('model.model', '=', model),
                 ('name', '=', name),
                 ])
         if not button_ids: