trytond 8.2.1__tar.gz → 8.2.2__tar.gz

{trytond-8.2.1 → trytond-8.2.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: trytond
-Version: 8.2.1
+Version: 8.2.2
 Summary: Tryton server
 Project-URL: homepage, https://www.tryton.org/
 Project-URL: documentation, https://docs.tryton.org/server/

{trytond-8.2.1 → trytond-8.2.2}/trytond/__init__.py

@@ -14,7 +14,7 @@ from lxml import etree, objectify
 
 from ._safe_genshi import genshi_patch
 
-__version__ = "8.2.1"
+__version__ = "8.2.2"
 __series__ = '.'.join(__version__.split('.')[:2])
 
 if not os.environ.get('TRYTOND_APPNAME'):

{trytond-8.2.1 → trytond-8.2.2}/trytond/ir/cron.py

@@ -36,7 +36,7 @@ def str2bigint(s):
 class Cron(DeactivableMixin, ModelSQL, ModelView):
     __name__ = "ir.cron"
     _states = {
-        'editable': Eval('running', False),
+        'editable': ~Eval('running', False),
         }
     interval_number = fields.Integer(
         "Interval Number", required=True, states=_states)

{trytond-8.2.1 → trytond-8.2.2}/trytond/ir/model.py

@@ -166,15 +166,18 @@ class Model(
             and model._on_change_notify_depends}
 
     @classmethod
-    def get_name_items(cls, classes=None):
+    def get_name_items(cls, classes=None, *other_classes):
         "Return a list of couple mapping models to names"
         pool = Pool()
-        key = 'items', str(classes)
+        key = 'items', str(classes), str(other_classes)
         items = cls._get_names_cache.get(key)
         if items is None:
             models = cls.search([])
             items = ((m.name, m.string) for m in models)
+            all_classes = list(other_classes)
             if classes:
+                all_classes.append(classes)
+            if all_classes:
                 def pool_get(model):
                     # During update existing model may not yet be in the pool
                     try:
@@ -183,17 +186,17 @@ class Model(
                         return object
                 items = (
                     (m, n) for m, n in items
-                    if issubclass(pool_get(m), classes))
+                    if all(issubclass(pool_get(m), k) for k in all_classes))
             items = cls._get_names_cache.set(key, list(items))
         return list(items)
 
     @classmethod
-    def get_names(cls, classes=None):
+    def get_names(cls, classes=None, *other_classes):
         "Return a dictionary mapping models to names"
-        key = 'dict', str(classes)
+        key = 'dict', str(classes), str(other_classes)
         dict_ = cls._get_names_cache.get(key)
         if dict_ is None:
-            dict_ = dict(cls.get_name_items(classes=classes))
+            dict_ = dict(cls.get_name_items(classes=classes, *other_classes))
             dict_ = cls._get_names_cache.set(key, dict_)
         return dict_
 

{trytond-8.2.1 → trytond-8.2.2}/trytond/ir/resource.py

@@ -49,7 +49,7 @@ class ResourceAccessMixin(ModelStorage):
         pool = Pool()
         Model = pool.get('ir.model')
         ModelAccess = pool.get('ir.model.access')
-        models = Model.get_name_items((ModelStorage, ModelView))
+        models = Model.get_name_items((ModelStorage,), (ModelView,))
         if Transaction().check_access:
             access = ModelAccess.get_access([m for m, _ in models])
             models = [(m, n) for m, n in models if access[m]['read']]

{trytond-8.2.1 → trytond-8.2.2}/trytond/pool.py

@@ -129,7 +129,7 @@ class Pool(object):
         :return: database list
         '''
         with cls._lock:
-            return list(cls._pools.keys())
+            return [n for n, p in cls._pools.items() if p]
 
     def init(self, update=None, lang=None, activatedeps=False, indexes=None):
         '''

{trytond-8.2.1 → trytond-8.2.2}/trytond/report/report.py

@@ -452,15 +452,15 @@ class Report(URLMixin, PoolBase):
                 '--convert-to "%(output_extension)s" '
                 '--outdir "%(directory)s" '
                 '"%(input_path)s"')
-            args = map(lambda s: s % {
-                    'directory': directory,
-                    'input_format': input_format,
-                    'input_extension': input_extension,
-                    'input_path': input_path,
-                    'output_format': output_format,
-                    'output_extension': output_extension,
-                    'output_path': output_path,
-                    }, shlex.split(cmd))
+            args = list(map(lambda s: s % {
+                        'directory': directory,
+                        'input_format': input_format,
+                        'input_extension': input_extension,
+                        'input_path': input_path,
+                        'output_format': output_format,
+                        'output_extension': output_extension,
+                        'output_path': output_path,
+                        }, shlex.split(cmd)))
             for count in range(retry, -1, -1):
                 if count != retry:
                     time.sleep(0.02 * (retry - count))

{trytond-8.2.1 → trytond-8.2.2}/trytond/tests/resource.py

@@ -1,11 +1,11 @@
 # This file is part of Tryton.  The COPYRIGHT file at the top level of
 # this repository contains the full copyright notices and license terms.
 from trytond.ir.note import NoteCopyMixin
-from trytond.model import ModelSQL
+from trytond.model import ModelSQL, ModelView
 from trytond.pool import Pool
 
 
-class TestResource(ModelSQL, NoteCopyMixin):
+class TestResource(ModelSQL, ModelView, NoteCopyMixin):
     __name__ = 'test.resource'
 
     @classmethod
@@ -13,7 +13,7 @@ class TestResource(ModelSQL, NoteCopyMixin):
         return {'test.resource.other'}
 
 
-class TestResourceOther(ModelSQL):
+class TestResourceOther(ModelSQL, ModelView):
     __name__ = 'test.resource.other'
 
 

{trytond-8.2.1 → trytond-8.2.2}/trytond/tests/test_wizard.py

@@ -30,6 +30,22 @@ class WizardTestCase(DBTestCase):
         session_id, _, _ = Wizard.create()
         Wizard.delete(session_id)
 
+    @with_transaction()
+    def test_delete_different_user(self):
+        "Delete session from a different user"
+        pool = Pool()
+        Wizard = pool.get('test.test_wizard', type='wizard')
+        User = pool.get('res.user')
+
+        user = User(login='foo')
+        user.save()
+
+        session_id, _, _ = Wizard.create()
+
+        with Transaction().set_user(user.id):
+            with self.assertRaises(AccessError):
+                Wizard.delete(session_id)
+
     @with_transaction()
     def test_session(self):
         'Session Wizard'
@@ -89,6 +105,22 @@ class WizardTestCase(DBTestCase):
             with self.assertRaises(AccessError):
                 session_id, start_state, end_state = Wizard.create()
 
+    @with_transaction()
+    def test_session_different_user(self):
+        "Use session from a different user"
+        pool = Pool()
+        Wizard = pool.get('test.test_wizard', type='wizard')
+        User = pool.get('res.user')
+
+        user = User(login='foo')
+        user.save()
+
+        session_id, _, _ = Wizard.create()
+
+        with Transaction().set_user(user.id):
+            with self.assertRaises(AccessError):
+                Wizard(session_id)
+
     @with_transaction()
     def test_execute(self):
         'Execute Wizard'
@@ -204,3 +236,44 @@ class WizardTestCase(DBTestCase):
                 with Transaction().set_context(
                         active_model='test.test_wizard.start'):
                     Wizard.execute(session_id, {}, start_state)
+
+    @with_transaction(context={'_check_access': True})
+    def test_execute_without_model(self):
+        "Execute wizard without model"
+        pool = Pool()
+        Wizard = pool.get('test.test_wizard_no_model', type='wizard')
+        User = pool.get('res.user')
+
+        user = User(login='foo')
+        user.save()
+        session_id, start_state, end_state = Wizard.create()
+
+        with Transaction().set_user(user.id):
+            with self.assertRaises(AccessError):
+                Wizard.execute(session_id, {}, start_state)
+
+    @with_transaction(context={'_check_access': True})
+    def test_execute_without_model_with_group(self):
+        "Execute wizard without model and groups"
+        pool = Pool()
+        Wizard = pool.get('test.test_wizard_no_model', type='wizard')
+        User = pool.get('res.user')
+        Group = pool.get('res.group')
+
+        user = User(login='foo', groups=[Group(name="Group")])
+        user.save()
+        session_id, start_state, end_state = Wizard.create()
+
+        with Transaction().set_user(user.id):
+            with self.assertRaises(AccessError):
+                Wizard.execute(session_id, {}, start_state)
+
+    @with_transaction(context={'_check_access': True})
+    def test_execute_without_model_with_admin(self):
+        "Execute wizard without model"
+        pool = Pool()
+        Wizard = pool.get('test.test_wizard_no_model', type='wizard')
+
+        session_id, start_state, end_state = Wizard.create()
+
+        Wizard.execute(session_id, {}, start_state)

{trytond-8.2.1 → trytond-8.2.2}/trytond/tests/wizard.py

@@ -47,10 +47,15 @@ class TestWizard(Wizard):
         return 'end'
 
 
+class TestWizardNoModel(TestWizard):
+    __name__ = 'test.test_wizard_no_model'
+
+
 def register(module):
     Pool.register(
         TestWizardStart,
         module=module, type_='model')
     Pool.register(
         TestWizard,
+        TestWizardNoModel,
         module=module, type_='wizard')

{trytond-8.2.1 → trytond-8.2.2}/trytond/tests/wizard.xml

@@ -21,5 +21,11 @@ this repository contains the full copyright notices and license terms. -->
             <field name="wiz_name">test.test_wizard</field>
             <field name="model">test.access</field>
         </record>
+
+        <record model="ir.action.wizard" id="test_wizard_no_model">
+            <field name="name">Test Wizard</field>
+            <field name="wiz_name">test.test_wizard_no_model</field>
+            <field name="model" eval="None"/>
+        </record>
     </data>
 </tryton>

{trytond-8.2.1 → trytond-8.2.2}/trytond/wizard/wizard.py

@@ -264,7 +264,7 @@ class Wizard(URLMixin, PoolBase):
                     ModelAccess.check(model, 'read')
                 models = ActionWizard.get_models(
                     cls.__name__, action_id=context.get('action_id'))
-                if model and models and model not in models:
+                if models and (not model or model not in models):
                     groups = Group.browse(User.get_groups())
                     raise AccessError(
                         gettext(
@@ -294,6 +294,12 @@ class Wizard(URLMixin, PoolBase):
                             ):
                         ModelAccess.check(model, 'write')
 
+                if not models and not wizard_groups:
+                    raise AccessError(
+                        gettext(
+                            'ir.msg_access_wizard_error',
+                            wizard=cls.__name__))
+
             if model:
                 ids = context.get('active_ids') or []
                 id_ = context.get('active_id')
@@ -312,14 +318,20 @@ class Wizard(URLMixin, PoolBase):
     @classmethod
     def delete(cls, session_id):
         "Delete the session"
-        Session = Pool().get('ir.session.wizard')
+        pool = Pool()
+        Session = pool.get('ir.session.wizard')
+        transaction = Transaction()
+        session = Session(session_id)
+        if session.create_uid.id != transaction.user:
+            raise AccessError(
+                gettext('ir.msg_access_wizard_error', wizard=cls.__name__))
         end = getattr(cls, cls.end_state, None)
         if end:
             wizard = cls(session_id)
             action = end(wizard)
         else:
             action = None
-        Session.delete([Session(session_id)])
+        Session.delete([session])
         return action
 
     @classmethod
@@ -401,8 +413,12 @@ class Wizard(URLMixin, PoolBase):
     def __init__(self, session_id):
         pool = Pool()
         Session = pool.get('ir.session.wizard')
-        self._session_id = session_id
+        transaction = Transaction()
         session = Session(session_id)
+        if session.create_uid.id != transaction.user:
+            raise AccessError(
+                gettext('ir.msg_access_wizard_error', wizard=self.__name__))
+        self._session_id = session.id
         data = defaultdict(dict)
         data.update(json.loads(session.data, object_hook=JSONDecoder()))
         for state_name, state in self.states.items():