From d5da26a5a6dc4d3a82a6a69c50dc468e7c35f6ce Mon Sep 17 00:00:00 2001 From: Jeremy Kersten Date: Thu, 19 Mar 2015 13:08:08 +0100 Subject: [PATCH] [FIX] mass_mailing: count recipients with SUPERUSER_ID to bypass security If a campaign was done to a list of Applicant, marketing team had an error loading the kanban view. Because to display the number of recipents, a search is done with a domain on hr.applicant. Model that except Human Resources / Officier, nobody can read. --- addons/mass_mailing/models/mass_mailing.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/addons/mass_mailing/models/mass_mailing.py b/addons/mass_mailing/models/mass_mailing.py index f3774f02252..01698773e34 100644 --- a/addons/mass_mailing/models/mass_mailing.py +++ b/addons/mass_mailing/models/mass_mailing.py @@ -7,6 +7,7 @@ import re from openerp import tools from openerp import models, api, _ +from openerp import SUPERUSER_ID from openerp.exceptions import UserError from openerp.tools.misc import DEFAULT_SERVER_DATETIME_FORMAT from openerp.tools.safe_eval import safe_eval as eval @@ -498,7 +499,7 @@ class MassMailing(osv.Model): result = {} for mass_mailing in mass_mailings: mailing = self.browse(cr, uid, mass_mailing.id, context=context) - result[mass_mailing.id] = len(self.get_recipients(cr, uid, mailing, context=context)) + result[mass_mailing.id] = len(self.get_recipients(cr, SUPERUSER_ID, mailing, context=context)) return result # indirections for inheritance