[FIX] Exploit Broken : Search should have checked access rights of read

lp bug: https://launchpad.net/bugs/531026 fixed bzr revid: jvo@tinyerp.com-20100512112627-z9g2no4ddrattx0z
2010-05-12 16:56:27 +05:30
parent 8972e42f8a
commit 22f85f783a
1 changed files with 2 additions and 1 deletions
@@ -3621,8 +3621,9 @@ class orm(orm_template):
            * '&' (default), '|', '!'

        """
-        if not context:
+        if context is None:
            context = {}
+        self.pool.get('ir.model.access').check(cr, user, self._name, 'read', context=context)
        # compute the where, order by, limit and offset clauses
        (qu1, qu2, tables) = self._where_calc(cr, user, args, context=context)
        dom = self.pool.get('ir.rule').domain_get(cr, user, self._name, 'read', context=context)