From 152d9de6cfc2f2187cc58ad71050670707e39342 Mon Sep 17 00:00:00 2001 From: Raphael Collet Date: Fri, 8 Jan 2016 11:58:26 +0100 Subject: [PATCH] [FIX] fields: in many2many fields, command `5` removes accessible records only --- openerp/osv/fields.py | 21 ++++++++++++--------- 1 file changed, 12 insertions(+), 9 deletions(-) diff --git a/openerp/osv/fields.py b/openerp/osv/fields.py index 464b203b29d..663d60f31b4 100644 --- a/openerp/osv/fields.py +++ b/openerp/osv/fields.py @@ -770,6 +770,16 @@ class many2many(_column): for sub_ids in cr.split_for_in_conditions(ids): cr.execute(query, (id, list(sub_ids), id)) + def unlink_all(): + # remove all records for which user has access rights + clauses, params, tables = obj.pool.get('ir.rule').domain_get(cr, user, obj._name, context=context) + cond = " AND ".join(clauses) if clauses else "1=1" + query = """ DELETE FROM {rel} USING {tables} + WHERE {rel}.{id1}=%s AND {rel}.{id2}={table}.id AND {cond} + """.format(rel=rel, id1=id1, id2=id2, + table=obj._table, tables=','.join(tables), cond=cond) + cr.execute(query, [id] + params) + for act in values: if not (isinstance(act, list) or isinstance(act, tuple)) or not act: continue @@ -785,16 +795,9 @@ class many2many(_column): elif act[0] == 4: link([act[1]]) elif act[0] == 5: - cr.execute('delete from '+rel+' where ' + id1 + ' = %s', (id,)) + unlink_all() elif act[0] == 6: - - d1, d2,tables = obj.pool.get('ir.rule').domain_get(cr, user, obj._name, context=context) - if d1: - d1 = ' and ' + ' and '.join(d1) - else: - d1 = '' - cr.execute('delete from '+rel+' where '+id1+'=%s AND '+id2+' IN (SELECT '+rel+'.'+id2+' FROM '+rel+', '+','.join(tables)+' WHERE '+rel+'.'+id1+'=%s AND '+rel+'.'+id2+' = '+obj._table+'.id '+ d1 +')', [id, id]+d2) - + unlink_all() link(act[2]) #