odoo
/
odoo
2
0
Fork 0
Code Pull Requests Releases Activity

[FIX] fields: in many2many fields, command `5` removes accessible records only

This commit is contained in:
Raphael Collet 2016-01-08 11:58:26 +01:00
parent 51e66711a9
commit 22d125fe96
1 changed files with 12 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
openerp/osv/fields.py
View File

@ -1016,6 +1016,16 @@ class many2many(_column):
for sub_ids in cr.split_for_in_conditions(ids):
cr.execute(query, (id, list(sub_ids), id))
def unlink_all():
# remove all records for which user has access rights
clauses, params, tables = obj.pool.get('ir.rule').domain_get(cr, user, obj._name, context=context)
cond = " AND ".join(clauses) if clauses else "1=1"
query = """ DELETE FROM {rel} USING {tables}
WHERE {rel}.{id1}=%s AND {rel}.{id2}={table}.id AND {cond}
""".format(rel=rel, id1=id1, id2=id2,
table=obj._table, tables=','.join(tables), cond=cond)
cr.execute(query, [id] + params)
for act in values:
if not (isinstance(act, list) or isinstance(act, tuple)) or not act:
continue
@ -1031,16 +1041,9 @@ class many2many(_column):
elif act[0] == 4:
link([act[1]])
elif act[0] == 5:
cr.execute('delete from '+rel+' where ' + id1 + ' = %s', (id,))
unlink_all()
elif act[0] == 6:
d1, d2,tables = obj.pool.get('ir.rule').domain_get(cr, user, obj._name, context=context)
if d1:
d1 = ' and ' + ' and '.join(d1)
else:
d1 = ''
cr.execute('delete from '+rel+' where '+id1+'=%s AND '+id2+' IN (SELECT '+rel+'.'+id2+' FROM '+rel+', '+','.join(tables)+' WHERE '+rel+'.'+id1+'=%s AND '+rel+'.'+id2+' = '+obj._table+'.id '+ d1 +')', [id, id]+d2)
unlink_all()
link(act[2])
#