From 22f85f783ada9dd1ece26f6cd1afb4ab08534b93 Mon Sep 17 00:00:00 2001
From: "Albert Cervera i Areny - http://www.NaN-tic.com" <>
Date: Wed, 12 May 2010 16:56:27 +0530
Subject: [PATCH] [FIX] Exploit Broken : Search  should have checked access
 rights of read

lp bug: https://launchpad.net/bugs/531026 fixed

bzr revid: jvo@tinyerp.com-20100512112627-z9g2no4ddrattx0z
---
 bin/osv/orm.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/bin/osv/orm.py b/bin/osv/orm.py
index 3baa8daa6fc..e5a417c008d 100644
--- a/bin/osv/orm.py
+++ b/bin/osv/orm.py
@@ -3621,8 +3621,9 @@ class orm(orm_template):
             * '&' (default), '|', '!'
 
         """
-        if not context:
+        if context is None:
             context = {}
+        self.pool.get('ir.model.access').check(cr, user, self._name, 'read', context=context)
         # compute the where, order by, limit and offset clauses
         (qu1, qu2, tables) = self._where_calc(cr, user, args, context=context)
         dom = self.pool.get('ir.rule').domain_get(cr, user, self._name, 'read', context=context)