From dfdd38e3b214ebc2e621c92add6d2adea2b909ce Mon Sep 17 00:00:00 2001 From: Aaron Bohy Date: Fri, 8 Jan 2016 08:29:53 +0100 Subject: [PATCH] [FIX] mail: Discuss: don't suggest to join private channels Problem was that administrators have access to every channels, even private channels they are not registered to, because when trying to join an existing channel, the autocomplete proposed every channels accessible for the user, but didn't filter private ones. This rev. makes sure to only suggest non-private channels. Also prevent '|' domain injection to disable filters (odoo/odoo@44e65e72d3a362dedf2e7084ae193b5d8d4be3ad) by using expression.py to build domain. --- addons/mail/models/mail_channel.py | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/addons/mail/models/mail_channel.py b/addons/mail/models/mail_channel.py index c34eae67f53..7986a56a168 100644 --- a/addons/mail/models/mail_channel.py +++ b/addons/mail/models/mail_channel.py @@ -500,13 +500,8 @@ class Channel(models.Model): values['channel_private_group'] = self.search([('channel_type', '=', 'channel'), ('public', '=', 'private'), ('channel_partner_ids', 'in', [my_partner_id])]).channel_info() return values - # TODO master: remove domain argument @api.model def channel_search_to_join(self, name=None, domain=None): - return self._channel_search_to_join(name) - - @api.model - def _channel_search_to_join(self, name=None, domain=None): """ Return the channel info of the channel the current partner can join :param name : the name of the researched channels :param domain : the base domain of the research @@ -514,9 +509,14 @@ class Channel(models.Model): """ if not domain: domain = [] - domain += [('channel_type', '=', 'channel'), ('channel_partner_ids', 'not in', [self.env.user.partner_id.id])] + domain = expression.AND([ + [('channel_type', '=', 'channel')], + [('channel_partner_ids', 'not in', [self.env.user.partner_id.id])], + [('public', '!=', 'private')], + domain + ]) if name: - domain.append(('name', 'ilike', '%'+name+'%')) + domain = expression.AND([domain, [('name', 'ilike', '%'+name+'%')]]) return self.search(domain).read(['name', 'public', 'uuid', 'channel_type']) @api.multi