Merge lp:~openerp-dev/openobject-addons/7.0-opw-607160-rgo into lp:openobject-addons/7.0

Proposed by Ravi Gohil (OpenERP)
Status: Merged
Merged at revision: 10039
Proposed branch: lp:~openerp-dev/openobject-addons/7.0-opw-607160-rgo
Merge into: lp:openobject-addons/7.0
Diff against target: 20 lines (+2/-1)
1 file modified
document_page/wizard/document_page_create_menu.py (+2/-1)
To merge this branch: bzr merge lp:~openerp-dev/openobject-addons/7.0-opw-607160-rgo
Reviewer Review Type Date Requested Status
Martin Trigaux (OpenERP) (community) Approve
Review via email: mp+218743@code.launchpad.net

Description of the change

Steps to reproduce the issue:
1) Install document_page module
2) Log-in with other than admin user
3) Go to "Knowledge/Pages/Pages" and try to create menu for one of the record(from one of the option in "more" drop-down list)

A warning will be faced saying,
"Access Denied

The requested operation cannot be completed due to security restrictions. Please contact your system administrator.

(Document type: ir.values, Operation: create)"

While creating menu, system will try to create record for "ir.values" object(with values "key=action" and "user_id=False") by mean of execution invert function(_action_inv(...)) of the function field "action" of "ir.ui.menu" model. And the global rule defined for "ir.values" object with domain [('key','=','default'),('user_id','=',user.id)] will deny the creation of records as the significance of this rule is to simply allow modification of default values for logged in user only.

Modification of this rule is not advisable hence it need to be fixed by allowing creation of menus for document pages with superuser. Kindly review the fix.

Thanks.

To post a comment you must log in.
Revision history for this message
Martin Trigaux (OpenERP) (mat-openerp) wrote :

LGTM, thanks

revno: 10039 [merge]
revision-id: <email address hidden>

review: Approve

Preview Diff

[H/L] Next/Prev Comment, [J/K] Next/Prev File, [N/P] Next/Prev Hunk
1=== modified file 'document_page/wizard/document_page_create_menu.py'
2--- document_page/wizard/document_page_create_menu.py 2012-12-06 14:56:32 +0000
3+++ document_page/wizard/document_page_create_menu.py 2014-05-08 06:10:07 +0000
4@@ -19,6 +19,7 @@
5 #
6 ##############################################################################
7
8+from openerp import SUPERUSER_ID
9 from openerp.osv import fields, osv
10
11 class document_page_create_menu(osv.osv_memory):
12@@ -70,7 +71,7 @@
13 value['res_id'] = page.id
14
15 action_id = obj_action.create(cr, uid, value)
16- menu_id = obj_menu.create(cr, uid, {
17+ menu_id = obj_menu.create(cr, SUPERUSER_ID, {
18 'name': data.menu_name,
19 'parent_id':data.menu_parent_id.id,
20 'icon': 'STOCK_DIALOG_QUESTION',