[FIX] share: use empty domain for shared actions, as ir.rules do enforce the filtering.
We must not use a normal domain for the shared action, because it may be constructed with records the user may not see (e.g. sharing tasks from a certain project does not give right to see the project itself.) Evaluating the domain of an action requires rights that the user will not have. Moreover, this is useless because ir.rules are created with each share access to filter appropriately the records, and they are evaluated as root user without risk of failed access right. bzr revid: odo@openerp.com-20110505162231-vbkh4vqrtk93yg1q
This commit is contained in:
@@ -158,7 +158,7 @@ class share_create(osv.osv_memory):
|
||||
user_obj = self.pool.get('res.users')
|
||||
values = {
|
||||
'name': (_('%s (Shared)') % wizard_data.action_id.name)[:64],
|
||||
'domain': wizard_data.domain,
|
||||
'domain': '[]',
|
||||
'context': wizard_data.action_id.context,
|
||||
'res_model': wizard_data.action_id.res_model,
|
||||
'view_mode': wizard_data.action_id.view_mode,
|
||||
|
||||
Reference in New Issue
Block a user