From dcdd1707b42740ccfd6e72bf72dcca63be0e729e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?C=C3=A9dric=20Krier?= Date: Sun, 14 Feb 2021 15:47:00 +0100 Subject: [PATCH] Check record rule in button decorator In order to relax internal control of record rules, they must be enforced on the button entry point. This is done by just reading the id of the records already stored. issue7638 review349381002 --- trytond/model/modelstorage.py | 2 +- trytond/model/modelview.py | 6 ++++++ 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/trytond/model/modelstorage.py b/trytond/model/modelstorage.py index 3da3a3f35c..aac7d2025e 100644 --- a/trytond/model/modelstorage.py +++ b/trytond/model/modelstorage.py @@ -25,7 +25,6 @@ from trytond.transaction import Transaction from trytond.pool import Pool from trytond.cache import LRUDict, LRUDictTransaction, freeze from trytond.rpc import RPC -from .modelview import ModelView from .descriptors import dualmethod __all__ = ['ModelStorage', 'EvalEnvironment'] @@ -121,6 +120,7 @@ class ModelStorage(Model): @classmethod def __setup__(cls): + from .modelview import ModelView super(ModelStorage, cls).__setup__() if issubclass(cls, ModelView): cls.__rpc__.update({ diff --git a/trytond/model/modelview.py b/trytond/model/modelview.py index c32c91c81b..eb3e9d28ee 100644 --- a/trytond/model/modelview.py +++ b/trytond/model/modelview.py @@ -719,6 +719,7 @@ class ModelView(Model): def button(func): @wraps(func) def wrapper(cls, records, *args, **kwargs): + from .modelstorage import ModelStorage pool = Pool() ModelAccess = pool.get('ir.model.access') Button = pool.get('ir.model.button') @@ -732,6 +733,11 @@ class ModelView(Model): if (transaction.user != 0) and check_access: ModelAccess.check(cls.__name__, 'read') + if issubclass(cls, ModelStorage): + # Check record rule access + cls.read([r.id for r in records + if r.id is not None and r.id >= 0], + ['id']) groups = set(User.get_groups()) button_groups = Button.get_groups(cls.__name__, func.__name__)