From 4509595762da0c08fdf182e2bdf952cbbe300667 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Krier?= <ced@b2ck.com>
Date: Mon, 10 Sep 2012 18:02:03 +0200
Subject: [PATCH] Fix search button clause in ModelButton.get_groups

CVE-2012-2238
issue2757
review478002
---
 CHANGELOG           | 1 +
 trytond/ir/model.py | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG b/CHANGELOG
index 8f12ad3ff8..f14be99ab2 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -1,3 +1,4 @@
+* Fix search button clause in ModelButton.get_groups (CVE-2012-2238)
 * Merge all kind of buttons
 * Use XML id for board action instead of id
 * Add states attribute to notebook
diff --git a/trytond/ir/model.py b/trytond/ir/model.py
index cfff099a6c..d25096559f 100644
--- a/trytond/ir/model.py
+++ b/trytond/ir/model.py
@@ -555,7 +555,7 @@ class ModelButton(ModelSQL, ModelView):
         Return a set of group ids for the named button on the model.
         '''
         button_ids = self.search([
-                ('model', '=', model),
+                ('model.model', '=', model),
                 ('name', '=', name),
                 ])
         if not button_ids: