From 5b225f9e6132787e262dc8168651b24c8e49e7be Mon Sep 17 00:00:00 2001 From: Olivier Nibart Date: Tue, 12 Dec 2023 16:41:20 +0100 Subject: [PATCH] 16.0][FIX] report_label fix a security issue that prevents regular users to print labels --- report_label/wizards/report_label_wizard.py | 4 ++-- report_label/wizards/report_label_wizard_line.py | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/report_label/wizards/report_label_wizard.py b/report_label/wizards/report_label_wizard.py index 0f96a4008a..fcea242ede 100644 --- a/report_label/wizards/report_label_wizard.py +++ b/report_label/wizards/report_label_wizard.py @@ -61,9 +61,9 @@ def _prepare_report_data(self): self.ensure_one() return { "label_format": self.label_paperformat_id.read()[0], - "label_template": self.label_template_view_id.key, + "label_template": self.label_template_view_id.sudo().key, "offset": self.offset, - "res_model": self.model_id.model, + "res_model": self.model_id.sudo().model, "lines": [ { "res_id": line.res_id, diff --git a/report_label/wizards/report_label_wizard_line.py b/report_label/wizards/report_label_wizard_line.py index aad39f9fec..196f763dc1 100644 --- a/report_label/wizards/report_label_wizard_line.py +++ b/report_label/wizards/report_label_wizard_line.py @@ -22,7 +22,7 @@ class ReportLabelWizardLine(models.TransientModel): def _compute_res_name(self): wizard = self.mapped("wizard_id") wizard.ensure_one() - res_model = wizard.model_id.model + res_model = wizard.model_id.sudo().model res_ids = self.mapped("res_id") names_map = dict(self.env[res_model].browse(res_ids).name_get()) for rec in self: