-
-
Notifications
You must be signed in to change notification settings - Fork 589
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[14.0][IMP] mail_restrict_follower_selection: allow to use ref in domain #1405
base: 14.0
Are you sure you want to change the base?
Conversation
With this is change it is now possible to use the `ref` function in the domain set in a parameter, allowing to include xmlids in the domain.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM
@@ -20,7 +20,7 @@ def _message_add_suggested_recipient( | |||
domain = self.env[ | |||
"mail.wizard.invite" | |||
]._mail_restrict_follower_selection_get_domain() | |||
eval_domain = safe_eval(domain) | |||
eval_domain = safe_eval(domain, locals_dict={"ref": self.env.ref}) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
It's probably safer to use a version of ref
that returns the id rather than the browse record, like Odoo does when interpreting XML data: https://github.com/odoo/odoo/blob/14.0/odoo/tools/convert.py#L62. That way there is no vector in which an attacker can call methods on a record from a domain.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks for the review @StefanRijnhart, good point.
I updated the PR.
Returning only the ID of the record. | ||
|
||
""" | ||
return env.ref(id_str, raise_if_not_found).id |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This is not going to work if not found, even without raising:
>>> env.ref("not.exists", False).id
Traceback (most recent call last):
File "<console>", line 1, in <module>
AttributeError: 'NoneType' object has no attribute 'id'
Your simplest option might be to just drop raise_if_not_found
from the method signature.
With this is change it is now possible to use the
ref
function in the domain set in a parameter, allowing to include xmlids in the domain.