From c48ceabbcae1e1f25f0e08a5a68794375d290a52 Mon Sep 17 00:00:00 2001 From: Christophe Matthieu Date: Tue, 20 Aug 2013 10:04:11 +0200 Subject: [PATCH] [IMP] website_contract: better check access rules bzr revid: chm@openerp.com-20130820080411-x5jjlcshwzmypfs4 --- addons/website_contract/controllers/main.py | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/addons/website_contract/controllers/main.py b/addons/website_contract/controllers/main.py index 674fef25343..a28ea95c9d0 100644 --- a/addons/website_contract/controllers/main.py +++ b/addons/website_contract/controllers/main.py @@ -12,13 +12,15 @@ class website_contract(http.Controller): partner_obj = request.registry['res.partner'] account_obj = request.registry['account.analytic.account'] + # public partner profile project_ids = partner_obj.search(request.cr, openerp.SUPERUSER_ID, [('website_testimonial', "!=", False), ('website_published', '=', True)]) if request.uid != website.get_public_user().id: contract_ids = account_obj.search(request.cr, openerp.SUPERUSER_ID, [(1, "=", 1)]) - for contract in account_obj.browse(request.cr, openerp.SUPERUSER_ID, contract_ids): - if contract.partner_id: - project_ids.append(contract.partner_id.id) + contract_project_ids = [contract.partner_id.id + for contract in account_obj.browse(request.cr, openerp.SUPERUSER_ID, contract_ids) if contract.partner_id] + # search for check access rules + project_ids += partner_obj.search(request.cr, request.uid, [('id', "in", contract_project_ids)]) project_ids = list(set(project_ids)) values = website.get_rendering_context({