From 5cec836abd4091d1002d34118480f0d6c554e99f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?C=C3=A9dric=20Krier?= Date: Mon, 17 Nov 2025 10:28:49 +0100 Subject: [PATCH] Enforce access check in HTML editor route Use .read and .write instead of .browse and .save when editing field via the HTML editor. Closes #14364 (grafted from 1103361fdaf6d9da12fe6455d871a4eba089d768) --HG-- branch : 7.0 --- trytond/CHANGELOG | 1 + trytond/trytond/ir/routes.py | 7 ++++--- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/trytond/CHANGELOG b/trytond/CHANGELOG index a63fe07010..1c3f60e220 100644 --- a/trytond/CHANGELOG +++ b/trytond/CHANGELOG @@ -1,3 +1,4 @@ +* Enforce access check in HTML editor route (issue14364) Version 7.0.39 - 2025-11-02 --------------------------- diff --git a/trytond/trytond/ir/routes.py b/trytond/trytond/ir/routes.py index e4128473d6..f164474c73 100644 --- a/trytond/trytond/ir/routes.py +++ b/trytond/trytond/ir/routes.py @@ -53,20 +53,21 @@ def html_editor(request, pool, model, record, field): with transaction.set_context(language=language): Model = pool.get(model) record = Model(record) + values = Model.read([record.id], ['rec_name', field.name])[0] status = HTTPStatus.OK error = '' if request.method == 'POST': setattr(record, field.name, request.form['text']) if request.form['_csrf_token'] == get_token(record): - record.save() + Model.write([record], {field.name: request.form['text']}) return redirect(request.url) else: status = HTTPStatus.BAD_REQUEST error = gettext('ir.msg_html_editor_save_fail') csrf_token = get_token(record) - text = getattr(record, field.name) or '' + text = values[field.name] or '' if isinstance(text, bytes): try: text = text.decode('utf-8') @@ -77,7 +78,7 @@ def html_editor(request, pool, model, record, field): abort(HTTPStatus.BAD_REQUEST) title = '%(model)s "%(name)s" %(field)s - %(title)s' % { 'model': field.model.name, - 'name': record.rec_name, + 'name': values['rec_name'], 'field': field.field_description, 'title': request.args.get('title', "Tryton"), }