From 314e1d8f46c593129e94dbfe06d8f8627c96e436 Mon Sep 17 00:00:00 2001 From: Olivier Dony Date: Thu, 15 Jul 2010 18:59:35 +0200 Subject: [PATCH] [IMP] res_user: security check to prevent users from switching to a company they do not belong to (thanks to xrg for reporting) bzr revid: odo@openerp.com-20100715165935-nlejai33n4m4o7ox --- bin/addons/base/res/res_user.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/bin/addons/base/res/res_user.py b/bin/addons/base/res/res_user.py index 023edc89dc5..b4e4bd163f9 100644 --- a/bin/addons/base/res/res_user.py +++ b/bin/addons/base/res/res_user.py @@ -360,7 +360,9 @@ class users(osv.osv): if not (key in self.SELF_WRITEABLE_FIELDS or key.startswith('context_')): break else: - uid = 1 # safe fields only, so we write as super-user + # check that user is not selecting an invalid company_id + if 'company_id' not in values or (values.get('company_id') in self.read(cr, uid, uid, ['company_ids'], context=context)['company_ids']): + uid = 1 # safe fields only, so we write as super-user to bypass access rights res = super(users, self).write(cr, uid, ids, values, context=context)