From a23e04aef73c584efd71437f8f123e43becfef83 Mon Sep 17 00:00:00 2001 From: Joren Van Onder Date: Mon, 8 May 2017 18:56:37 -0700 Subject: [PATCH] [FIX] payment_*: always read callback_eval as superuser The callback_eval field has a groups parameter of base.group_system. Without this patch everyone not part of that group ends up with an access right error when the system attempts to read that field. Previously this was not a problem because all code reading callback_eval was executed with the superuser already. New code has been introduced however that does not do this (eg. paying with a payment.token from the backend). opw-741181 --- addons/payment_authorize/models/payment.py | 8 ++++---- addons/payment_ogone/models/payment.py | 8 ++++---- addons/payment_stripe/models/payment.py | 4 ++-- 3 files changed, 10 insertions(+), 10 deletions(-) diff --git a/addons/payment_authorize/models/payment.py b/addons/payment_authorize/models/payment.py index 2f2037dc95a..ffc2138e859 100644 --- a/addons/payment_authorize/models/payment.py +++ b/addons/payment_authorize/models/payment.py @@ -285,15 +285,15 @@ class TxAuthorize(models.Model): 'acquirer_reference': tree.get('x_trans_id'), 'date_validate': fields.Datetime.now(), }) - if self.callback_eval and init_state != 'authorized': - safe_eval(self.callback_eval, {'self': self}) + if self.sudo().callback_eval and init_state != 'authorized': + safe_eval(self.sudo().callback_eval, {'self': self}) if tree.get('x_type').lower() == 'auth_only': self.write({ 'state': 'authorized', 'acquirer_reference': tree.get('x_trans_id'), }) - if self.callback_eval: - safe_eval(self.callback_eval, {'self': self}) + if self.sudo().callback_eval: + safe_eval(self.sudo().callback_eval, {'self': self}) if tree.get('x_type').lower() == 'void': self.write({ 'state': 'cancel', diff --git a/addons/payment_ogone/models/payment.py b/addons/payment_ogone/models/payment.py index 2315091f10a..200c48ef636 100644 --- a/addons/payment_ogone/models/payment.py +++ b/addons/payment_ogone/models/payment.py @@ -304,8 +304,8 @@ class PaymentTxOgone(models.Model): }) vals.update(payment_token_id=pm.id) self.write(vals) - if self.callback_eval: - safe_eval(self.callback_eval, {'self': self}) + if self.sudo().callback_eval: + safe_eval(self.sudo().callback_eval, {'self': self}) return True elif status in self._ogone_cancel_tx_status: self.write({ @@ -410,8 +410,8 @@ class PaymentTxOgone(models.Model): 'name': tree.get('CARDNO'), }) self.write({'payment_token_id': pm.id}) - if self.callback_eval: - safe_eval(self.callback_eval, {'self': self}) + if self.sudo().callback_eval: + safe_eval(self.sudo().callback_eval, {'self': self}) return True elif status in self._ogone_cancel_tx_status: self.write({ diff --git a/addons/payment_stripe/models/payment.py b/addons/payment_stripe/models/payment.py index edec99e41ab..fa77498419e 100644 --- a/addons/payment_stripe/models/payment.py +++ b/addons/payment_stripe/models/payment.py @@ -140,8 +140,8 @@ class PaymentTransactionStripe(models.Model): 'date_validate': fields.datetime.now(), 'acquirer_reference': tree.get('id'), }) - if self.callback_eval: - safe_eval(self.callback_eval, {'self': self}) + if self.sudo().callback_eval: + safe_eval(self.sudo().callback_eval, {'self': self}) return True else: error = tree['error']['message']