From b1bcc6b036674f674ee3ef9f2568743faddfc4ee Mon Sep 17 00:00:00 2001 From: Olivier Dony Date: Thu, 5 May 2011 18:22:31 +0200 Subject: [PATCH] [FIX] share: use empty domain for shared actions, as ir.rules do enforce the filtering. We must not use a normal domain for the shared action, because it may be constructed with records the user may not see (e.g. sharing tasks from a certain project does not give right to see the project itself.) Evaluating the domain of an action requires rights that the user will not have. Moreover, this is useless because ir.rules are created with each share access to filter appropriately the records, and they are evaluated as root user without risk of failed access right. bzr revid: odo@openerp.com-20110505162231-vbkh4vqrtk93yg1q --- addons/share/wizard/share_wizard.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/addons/share/wizard/share_wizard.py b/addons/share/wizard/share_wizard.py index cae12ddbfe7..f153f26f4d4 100644 --- a/addons/share/wizard/share_wizard.py +++ b/addons/share/wizard/share_wizard.py @@ -158,7 +158,7 @@ class share_create(osv.osv_memory): user_obj = self.pool.get('res.users') values = { 'name': (_('%s (Shared)') % wizard_data.action_id.name)[:64], - 'domain': wizard_data.domain, + 'domain': '[]', 'context': wizard_data.action_id.context, 'res_model': wizard_data.action_id.res_model, 'view_mode': wizard_data.action_id.view_mode,