From d39d3703217096949e9df353aa81e3f6a6f4201e Mon Sep 17 00:00:00 2001
From: nvi-openerp <nicolas.vanhoren@openerp.com>
Date: Tue, 23 Nov 2010 11:27:06 +0100
Subject: [PATCH] [IMP] Improved res_log for security

bzr revid: nicolas.vanhoren@openerp.com-20101123102706-0bofalz0dgwjs60v
---
 bin/addons/base/publisher_warranty/publisher_warranty.py | 7 ++++++-
 bin/addons/base/res/res_log.py                           | 6 ++++--
 bin/addons/base/res/res_log_view.xml                     | 1 +
 3 files changed, 11 insertions(+), 3 deletions(-)

diff --git a/bin/addons/base/publisher_warranty/publisher_warranty.py b/bin/addons/base/publisher_warranty/publisher_warranty.py
index b6ba70a12c1..0cf8cc6cc72 100644
--- a/bin/addons/base/publisher_warranty/publisher_warranty.py
+++ b/bin/addons/base/publisher_warranty/publisher_warranty.py
@@ -31,7 +31,6 @@ from tools.safe_eval import safe_eval
 import pooler
 from tools.config import config
 import release
-import datetime
 
 _logger = logging.getLogger(__name__)
 
@@ -165,6 +164,7 @@ class publisher_warranty_contract(osv.osv):
                         'name': result["message"],
                         'res_model': "Maintenance Notifications",
                         "read": True,
+                        "broadcast": True,
                     },
                     context=context
             )
@@ -178,6 +178,11 @@ class publisher_warranty_contract(osv.osv):
         return True
     
     def get_last_user_message(self, cr, uid, context={}):
+        """
+        Get the message to be written in the web client.
+        @return: An html message, can be False instead.
+        @rtype: string
+        """
         ids = self.pool.get('res.log').search(cr, uid, [("res_model", "=", "Maintenance Notifications")]
                                         , order="create_date desc", limit=1)
         if not ids:
diff --git a/bin/addons/base/res/res_log.py b/bin/addons/base/res/res_log.py
index 8ac53acae6b..c2752fdd131 100644
--- a/bin/addons/base/res/res_log.py
+++ b/bin/addons/base/res/res_log.py
@@ -32,12 +32,14 @@ class res_log(osv.osv):
         'res_id': fields.integer('Object ID'),
         'secondary': fields.boolean('Secondary Log', help='Do not display this log if it belongs to the same object the user is working on'),
         'create_date': fields.datetime('Created Date', readonly=True),
-        'read': fields.boolean('Read', help="If this log item has been read, get() should not send it to the client")
+        'read': fields.boolean('Read', help="If this log item has been read, get() should not send it to the client"),
+        'broadcast': fields.boolean('Broadcast', help="For security, tells if all users should have right to read this log."),
     }
     _defaults = {
         'user_id': lambda self,cr,uid,ctx: uid,
         'context': "{}",
-        'read': False
+        'read': False,
+        'broadcast': False,
     }
     _order='create_date desc'
 
diff --git a/bin/addons/base/res/res_log_view.xml b/bin/addons/base/res/res_log_view.xml
index 4fc137eb26b..c73d5ddfe61 100644
--- a/bin/addons/base/res/res_log_view.xml
+++ b/bin/addons/base/res/res_log_view.xml
@@ -44,6 +44,7 @@
                       <field name="user_id" />
                       <field name="res_model"/>
                       <field name="res_id"/>
+                      <field name="broadcast"/>
                   </group>
                 </form>
             </field>