odoo
/
odoo
2
0
Fork 0
Code Pull Requests Releases Activity

[FIX] web: on record reload (form & list view), use search_read instead of read, to check if the user can still read the record (security rules) 

bzr revid: dle@openerp.com-20140326113036-g9yv3jj6yetwxvg8
This commit is contained in:
Denis Ledoux 2014-03-26 12:30:36 +01:00
parent c0103c387d
commit 162ad1c0f1
2 changed files with 13 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
addons/web/static/src/js/view_form.js
View File

@ -951,14 +951,20 @@ instance.web.FormView = instance.web.View.extend(instance.web.form.FieldManagerM
} else {
var fields = _.keys(self.fields_view.fields);
fields.push('display_name');
return self.dataset.read_index(fields,
// Use of search_read instead of read to check if we can still read the record (security rules)
return self.dataset.call('search_read', [[['id', '=', self.dataset.ids[self.dataset.index]]], fields],
{
context: {
'bin_size': true,
'future_display_name': true
}
}).then(function(r) {
self.trigger('load_record', r);
if (_.isEmpty(r)){
self.do_action('history_back');
}
else{
self.trigger('load_record', r[0]);
}
});
}
});

9
addons/web/static/src/js/view_list.js
View File

@ -528,13 +528,14 @@ instance.web.ListView = instance.web.View.extend( /** @lends instance.web.ListVi
},
reload_record: function (record) {
var self = this;
return this.dataset.read_ids(
[record.get('id')],
// Use of search_read instead of read to check if we can still read the record (security rules)
return this.dataset.call('search_read', [
[['id', '=', record.get('id')]],
_.pluck(_(this.columns).filter(function (r) {
return r.tag === 'field';
}), 'name')
}), 'name')]
).done(function (records) {
var values = records[0];
var values = _.isEmpty(records) ? undefined : records[0];
if (!values) {
self.records.remove(record);
return;