changeset 8d57e541630f in trytond:5.4
details: https://hg.tryton.org/trytond?cmd=changeset;node=8d57e541630f
description:
Check model read access only on wizard with table_query models
issue9251
review297631002
(grafted from ce5ad8f394402a99bc7d96a594317e849257d34f)
diffstat:
trytond/wizard/wizard.py | 6 +++++-
1 files changed, 5 insertions(+), 1 deletions(-)
diffs (23 lines):
diff -r c21565dd7c70 -r 8d57e541630f trytond/wizard/wizard.py
--- a/trytond/wizard/wizard.py Tue Apr 21 14:06:10 2020 +0200
+++ b/trytond/wizard/wizard.py Sat Apr 25 08:50:14 2020 +0200
@@ -12,6 +12,7 @@
from trytond.transaction import Transaction
from trytond.url import URLMixin
from trytond.protocols.jsonrpc import JSONDecoder, JSONEncoder
+from trytond.model import ModelSQL
from trytond.model.fields import states_validate
from trytond.pyson import PYSONEncoder
from trytond.rpc import RPC
@@ -237,7 +238,10 @@
raise UserError('Calling wizard %s is not allowed!'
% cls.__name__)
elif model and model != 'ir.ui.menu':
- ModelAccess.check(model, 'write')
+ Model = pool.get(model)
+ if (not callable(getattr(Model, 'table_query', None))
+ or Model.write.__func__ != ModelSQL.write.__func__):
+ ModelAccess.check(model, 'write')
@classmethod
def create(cls):
