From 5fa1a3e91bb501f2d4527bb9fdb3d21b97db5400 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?C=C3=A9dric=20Krier?= Date: Mon, 5 Apr 2021 15:15:38 +0200 Subject: [PATCH] Enforce access rights when searching in wizard If there are no constraint based on the records on the search domain, we must enforce the access rights to limit the execution to the user accesses. issue10229 review335931002 --- dunning.py | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/dunning.py b/dunning.py index 45a6d6e1b5..b6109d75ff 100644 --- a/dunning.py +++ b/dunning.py @@ -236,10 +236,13 @@ class Dunning(ModelSQL, ModelView): date = Date.today() set_level = defaultdict(list) - for dunning in cls.search([ + with Transaction().set_context(_check_access=True): + dunnings = cls.search([ ('state', '=', 'waiting'), ('blocked', '=', False), - ]): + ]) + dunnings = cls.browse(dunnings) + for dunning in dunnings: procedure = dunning.procedure levels = procedure.levels levels = levels[levels.index(dunning.level) + 1:] @@ -267,7 +270,9 @@ class Dunning(ModelSQL, ModelView): if to_write: cls.write(*to_write) - lines = MoveLine.search(cls._overdue_line_domain(date)) + with Transaction().set_context(_check_access=True): + lines = MoveLine.search(cls._overdue_line_domain(date)) + lines = MoveLine.browse(lines) dunnings = (cls._get_dunning(line, date) for line in lines) cls.save([d for d in dunnings if d])