From 5999bb231d31f79e54ba46358a249f08101eb288 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?C=C3=A9dric=20Krier?= Date: Wed, 16 Dec 2015 13:47:33 +0100 Subject: [PATCH] Check all fields when writing a sequence of records, values issue5167 review22631002 --- CHANGELOG | 1 + trytond/model/modelstorage.py | 9 +++++---- 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/CHANGELOG b/CHANGELOG index 3aa34737c8..927821383f 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -1,3 +1,4 @@ +* Check all fields when writing a sequence of records, values (CVE-2015-0861) * Add view_ids on tree view * Add parent_of operator * Enforce type of inheriting view diff --git a/trytond/model/modelstorage.py b/trytond/model/modelstorage.py index 3bf82697b7..0d447dceac 100644 --- a/trytond/model/modelstorage.py +++ b/trytond/model/modelstorage.py @@ -147,18 +147,19 @@ class ModelStorage(Model): ModelAccess = pool.get('ir.model.access') ModelFieldAccess = pool.get('ir.model.field.access') - ModelAccess.check(cls.__name__, 'write') - ModelFieldAccess.check(cls.__name__, - [x for x in values if x in cls._fields], 'write') - assert not len(args) % 2 actions = iter((records, values) + args) all_records = [] + all_fields = set() for records, values in zip(actions, actions): if not cls.check_xml_record(records, values): cls.raise_user_error('write_xml_record', error_description='xml_record_desc') all_records += records + all_fields.update(values.iterkeys()) + + ModelAccess.check(cls.__name__, 'write') + ModelFieldAccess.check(cls.__name__, all_fields, 'write') # Increase transaction counter Transaction().counter += 1