From 44e65e72d3a362dedf2e7084ae193b5d8d4be3ad Mon Sep 17 00:00:00 2001 From: Martin Trigaux Date: Fri, 8 Jan 2016 08:59:30 +0100 Subject: [PATCH] [FIX] mail: ignore abritrary argument domain for searching channel We should not trust arbitrary arguments from public method to compose a domain as it is possible to inject '|' to disable filters and be able to search any channel (mitigated by access rules). Create a private method and use a wrapper that ignores the domain. --- addons/mail/models/mail_channel.py | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/addons/mail/models/mail_channel.py b/addons/mail/models/mail_channel.py index c4fa5d98e4e..c34eae67f53 100644 --- a/addons/mail/models/mail_channel.py +++ b/addons/mail/models/mail_channel.py @@ -500,8 +500,13 @@ class Channel(models.Model): values['channel_private_group'] = self.search([('channel_type', '=', 'channel'), ('public', '=', 'private'), ('channel_partner_ids', 'in', [my_partner_id])]).channel_info() return values + # TODO master: remove domain argument @api.model def channel_search_to_join(self, name=None, domain=None): + return self._channel_search_to_join(name) + + @api.model + def _channel_search_to_join(self, name=None, domain=None): """ Return the channel info of the channel the current partner can join :param name : the name of the researched channels :param domain : the base domain of the research