From c877df2ec4e67f82b918435ed134f911ce8ab617 Mon Sep 17 00:00:00 2001 From: "Dharti Ratani (Open ERP)" Date: Thu, 23 May 2013 12:55:49 +0530 Subject: [PATCH 1/3] [FIX]Added record rules for documents of a directory as per the permissions defined in document access_permission.rst bzr revid: dhr@tinyerp.com-20130523072549-9gruk52goe4xhvy2 --- .../document/security/document_security.xml | 25 +++++++++++++++++++ 1 file changed, 25 insertions(+) diff --git a/addons/document/security/document_security.xml b/addons/document/security/document_security.xml index a7ec76eafac..2588ec4cc17 100644 --- a/addons/document/security/document_security.xml +++ b/addons/document/security/document_security.xml @@ -37,5 +37,30 @@ + + + + ['|','|','|',('parent_id','=',False) , ('parent_id.group_ids','in',[g.id for g in user.groups_id]), ('parent_id.user_id', '=', user.id), '&', ('parent_id.user_id', '=', False), ('parent_id.group_ids','=',False), '|','|', ('company_id','=',False), ('company_id','child_of',[user.company_id.id]),('company_id.child_ids','child_of',[user.company_id.id])] + Read public documents + + + + + + + + + + + [ '|', ('parent_id.user_id', '=', user.id), '&', ('parent_id.group_ids','in',[g.id for g in user.groups_id]), ('parent_id.user_id','=',False), '|','|', ('company_id','=',False), ('company_id','child_of',[user.company_id.id]),('company_id.child_ids','child_of',[user.company_id.id])] + Document modify own document + + + + + + + + From 5480f2958e34d5cb36de2f9506cee6516c4f4967 Mon Sep 17 00:00:00 2001 From: Martin Trigaux Date: Mon, 22 Jul 2013 13:51:06 +0200 Subject: [PATCH 2/3] [FIX] same without record rules, python side bzr revid: mat@openerp.com-20130722115106-b1uldamgbpisf84g --- addons/document/document.py | 16 ++++-- .../document/security/document_security.xml | 52 +------------------ 2 files changed, 12 insertions(+), 56 deletions(-) diff --git a/addons/document/document.py b/addons/document/document.py index 1671b6bc1ba..a841f071b91 100644 --- a/addons/document/document.py +++ b/addons/document/document.py @@ -69,11 +69,17 @@ class document_file(osv.osv): ] def check(self, cr, uid, ids, mode, context=None, values=None): - """Check access wrt. res_model, relax the rule of ir.attachment parent - With 'document' installed, everybody will have access to attachments of - any resources they can *read*. - """ - return super(document_file, self).check(cr, uid, ids, mode='read', context=context, values=values) + super(document_file, self).check(cr, uid, ids, mode, context=context, values=values) + if ids: + # use SQL to avoid recursive loop on read + cr.execute('SELECT id, parent_id from ir_attachment WHERE id in %s', (tuple(ids),)) + + parent_ids = [] + for attach_id, attach_parent in cr.fetchall(): + if attach_parent: + parent_ids.append(attach_parent) + + self.pool.get('document.directory').check_access_rule(cr, uid, parent_ids, mode, context=context) def search(self, cr, uid, args, offset=0, limit=None, order=None, context=None, count=False): # Grab ids, bypassing 'count' diff --git a/addons/document/security/document_security.xml b/addons/document/security/document_security.xml index b67ffb4548d..d8462d07386 100644 --- a/addons/document/security/document_security.xml +++ b/addons/document/security/document_security.xml @@ -37,56 +37,6 @@ - - - - [ - '|', - '|', - '|', - ('parent_id','=',False), - ('parent_id.group_ids','in',[g.id for g in user.groups_id]), - ('parent_id.user_id', '=', user.id), - '&', - ('parent_id.user_id', '=', False), - ('parent_id.group_ids','=',False), - '|', - '|', - ('company_id','=',False), - ('company_id','child_of',[user.company_id.id]), - ('company_id.child_ids','child_of',[user.company_id.id])] - - Read public documents - - - - - - - - - - - [ - '|', - ('parent_id.user_id', '=', user.id), - '&', - ('parent_id.group_ids','in',[g.id for g in user.groups_id]), - ('parent_id.user_id','=',False), - '|', - '|', - ('company_id','=',False), - ('company_id','child_of',[user.company_id.id]), - ('company_id.child_ids','child_of',[user.company_id.id])] - - Document modify own document - - - - - - - - + From 8ffa0fec98393e151ab5c23ee1db8998ef55e196 Mon Sep 17 00:00:00 2001 From: Martin Trigaux Date: Mon, 22 Jul 2013 15:27:15 +0200 Subject: [PATCH 3/3] [FIX] better check bzr revid: mat@openerp.com-20130722132715-r67xneyv85lbsung --- addons/document/document.py | 13 +++++-------- 1 file changed, 5 insertions(+), 8 deletions(-) diff --git a/addons/document/document.py b/addons/document/document.py index a841f071b91..a39be42e77c 100644 --- a/addons/document/document.py +++ b/addons/document/document.py @@ -69,17 +69,14 @@ class document_file(osv.osv): ] def check(self, cr, uid, ids, mode, context=None, values=None): + """Overwrite check to verify access on directory to validate specifications of doc/access_permissions.rst""" super(document_file, self).check(cr, uid, ids, mode, context=context, values=values) if ids: + self.pool.get('ir.model.access').check(cr, uid, 'document.directory', mode) + # use SQL to avoid recursive loop on read - cr.execute('SELECT id, parent_id from ir_attachment WHERE id in %s', (tuple(ids),)) - - parent_ids = [] - for attach_id, attach_parent in cr.fetchall(): - if attach_parent: - parent_ids.append(attach_parent) - - self.pool.get('document.directory').check_access_rule(cr, uid, parent_ids, mode, context=context) + cr.execute('SELECT DISTINCT parent_id from ir_attachment WHERE id in %s AND parent_id is not NULL', (tuple(ids),)) + self.pool.get('document.directory').check_access_rule(cr, uid, [parent_id for (parent_id,) in cr.fetchall()], mode, context=context) def search(self, cr, uid, args, offset=0, limit=None, order=None, context=None, count=False): # Grab ids, bypassing 'count'