From 4d9ce4260f820a762095f97ea307859bc782d038 Mon Sep 17 00:00:00 2001 From: Olivier Dony Date: Thu, 5 May 2011 18:25:08 +0200 Subject: [PATCH] [FIX] share: current user restrictions were not properly copied This could lead to security issues, because shared users could have more access rights than the user sharing the data. The mechanism was working to copy them, but unfortunately not working. bzr revid: odo@openerp.com-20110505162508-3r12bl7rg1hpyzps --- addons/share/wizard/share_wizard.py | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/addons/share/wizard/share_wizard.py b/addons/share/wizard/share_wizard.py index f153f26f4d4..364e4127b93 100644 --- a/addons/share/wizard/share_wizard.py +++ b/addons/share/wizard/share_wizard.py @@ -271,21 +271,21 @@ class share_create(osv.osv_memory): user_obj = self.pool.get('res.users') rule_obj = self.pool.get('ir.rule') current_user = user_obj.browse(cr, uid, uid, context=context) - completed_models = set() + rules_done = set() for group in current_user.groups_id: for dummy, model in fields_relations: - if model.id in completed_models: - continue - completed_models.add(model.id) for rule in group.rule_groups: - if rule.model_id == model.id: + if rule.id in rules_done: + continue + rules_done.add(rule.id) + if rule.model_id.id == model.id: if 'user.' in rule.domain_force: # Above pattern means there is likely a condition # specific to current user, so we must copy the rule using # the evaluated version of the domain. # And it's better to copy one time too much than too few rule_obj.copy(cr, 1, rule.id, default={ - 'name': '%s (%s)' %(rule.name, _('(Copy for sharing)')), + 'name': '%s %s' %(rule.name, _('(Copy for sharing)')), 'groups': [(6,0,[group_id])], 'domain_force': rule.domain, # evaluated version! })