openerp-community team mailing list archive

[Niels Huylebroeck <niels@xxxxxxxxxxxxx>]

Niels Huylebroeck has proposed merging lp:~openerp-community/openobject-server/fix-1094212-multicompany-res_partner into lp:openobject-server/7.0.

Requested reviews:
  OpenERP Core Team (openerp)
Related bugs:
  Bug #1094212 in OpenERP Server: "partner search & record rules & muliticompanies"
  https://bugs.launchpad.net/openobject-server/+bug/1094212

For more details, see:
https://code.launchpad.net/~openerp-community/openobject-server/fix-1094212-multicompany-res_partner/+merge/141936

The problem:

The result of cr.execute is bad (why hasn't everyone at openerp been brainwashed yet?) because it will contain results not appropriate for the current user (because of un-applied record rules)

The solution:

After we fetched the result cr.execute I now force the search to be executed (unconditionally) which is no problem even if "args" was not passed (see beginning of function where it is set to [] if it was None). Doing this search it will pass all the ids we have found so far but will also apply the required record rules, thus filtering out the unreadable partner ids in the process.

-- 
https://code.launchpad.net/~openerp-community/openobject-server/fix-1094212-multicompany-res_partner/+merge/141936
Your team OpenERP Community is subscribed to branch lp:~openerp-community/openobject-server/fix-1094212-multicompany-res_partner.

=== modified file 'openerp/addons/base/res/res_partner.py'
--- openerp/addons/base/res/res_partner.py	2012-12-21 12:06:31 +0000
+++ openerp/addons/base/res/res_partner.py	2013-01-04 15:27:25 +0000
@@ -463,8 +463,7 @@
                              OR partner.name || ' (' || COALESCE(company.name,'') || ')'
                           ''' + operator + ' %(name)s ' + limit_str, query_args)
             ids = map(lambda x: x[0], cr.fetchall())
-            if args:
-                ids = self.search(cr, uid, [('id', 'in', ids)] + args, limit=limit, context=context)
+            ids = self.search(cr, uid, [('id', 'in', ids)] + args, limit=limit, context=context)
             if ids:
                 return self.name_get(cr, uid, ids, context)
         return super(res_partner,self).name_search(cr, uid, name, args, operator=operator, context=context, limit=limit)