[FIX] share: use empty domain for shared actions, as ir.rules do enforce the filtering.

We must not use a normal domain for the shared action,
because it may be constructed with records the user may
not see (e.g. sharing tasks from a certain project does
not give right to see the project itself.)
Evaluating the domain of an action requires rights that
the user will not have. Moreover, this is useless because
ir.rules are created with each share access to filter
appropriately the records, and they are evaluated as 
root user without risk of failed access right.

bzr revid: odo@openerp.com-20110505162231-vbkh4vqrtk93yg1q
This commit is contained in:
Olivier Dony
2011-05-05 18:22:31 +02:00
parent b26d354d34
commit b1bcc6b036
+1 -1
View File
@@ -158,7 +158,7 @@ class share_create(osv.osv_memory):
user_obj = self.pool.get('res.users')
values = {
'name': (_('%s (Shared)') % wizard_data.action_id.name)[:64],
'domain': wizard_data.domain,
'domain': '[]',
'context': wizard_data.action_id.context,
'res_model': wizard_data.action_id.res_model,
'view_mode': wizard_data.action_id.view_mode,