From 79cd0848c13133308ddb62b718844ce2b5131d9e Mon Sep 17 00:00:00 2001 From: Olivier Dony Date: Thu, 27 Jan 2011 16:45:32 +0100 Subject: [PATCH] [FIX] ir_attachment: typo introduced in previous fix (3318) Original revision: 3318 - nel@tinyerp.com-20110121084241-10kfmgd16vt19vkv The consequence is that access rights on attachments would be incorrectly checked, using the intersection of the attachment IDs and the resource IDs. bzr revid: odo@openerp.com-20110127154532-v18l28qk8ysi02sb --- bin/addons/base/ir/ir_attachment.py | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/bin/addons/base/ir/ir_attachment.py b/bin/addons/base/ir/ir_attachment.py index 74502d374d2..480d6782912 100644 --- a/bin/addons/base/ir/ir_attachment.py +++ b/bin/addons/base/ir/ir_attachment.py @@ -44,10 +44,13 @@ class ir_attachment(osv.osv): if values: if 'res_model' in values and 'res_id' in values: res_ids.setdefault(values['res_model'],[]).append(values['res_id']) - + for model, mids in res_ids.items(): - cr.execute('select id from '+self.pool.get(model)._table+' where id in %s', (tuple(ids),)) + # ignore attachments that are not attached to a resource anymore when checking access rights + # (resource was deleted but attachment was not) + cr.execute('select id from '+self.pool.get(model)._table+' where id in %s', (tuple(mids),)) mids = [x[0] for x in cr.fetchall()] + self.pool.get(model).check_access_rule(cr, uid, mids, mode, context=context) def search(self, cr, uid, args, offset=0, limit=None, order=None,