diff --git a/trytond/CHANGELOG b/trytond/CHANGELOG index 5b4280f44a..3317ef12af 100644 --- a/trytond/CHANGELOG +++ b/trytond/CHANGELOG @@ -1,3 +1,4 @@ +* Enforce access right on the email template record (issue14907) * Add ModelAccessProxy (issue14907) * Restrict Genshi evaluation (issue14869, issue5160) diff --git a/trytond/trytond/ir/email_.py b/trytond/trytond/ir/email_.py index b792431475..d60a35f49b 100644 --- a/trytond/trytond/ir/email_.py +++ b/trytond/trytond/ir/email_.py @@ -10,7 +10,8 @@ from genshi.template import TextTemplate import trytond.config as config from trytond.i18n import gettext -from trytond.model import EvalEnvironment, ModelSQL, ModelView, fields +from trytond.model import ( + EvalEnvironment, ModelAccessProxy, ModelSQL, ModelView, fields) from trytond.model.exceptions import AccessError, ValidationError from trytond.pool import Pool from trytond.pyson import Bool, Eval, PYSONDecoder @@ -400,7 +401,7 @@ class EmailTemplate(ModelSQL, ModelView): def get(self, record): pool = Pool() Model = pool.get(self.model.name) - record = Model(int(record)) + record = ModelAccessProxy(Model(int(record))) values = {} for attr, key in [