Fix search button clause in ModelButton.get_groups

CVE-2012-2238 issue2757 review478002
tryton · Sep 10, 2012 · 4509595 · 4509595
1 parent 4dcb7b6
commit 4509595
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 1 deletion.
diff --git a/CHANGELOG b/CHANGELOG
@@ -1,3 +1,4 @@
+* Fix search button clause in ModelButton.get_groups (CVE-2012-2238)
 * Merge all kind of buttons
 * Use XML id for board action instead of id
 * Add states attribute to notebook

diff --git a/trytond/ir/model.py b/trytond/ir/model.py
@@ -555,7 +555,7 @@ def get_groups(self, model, name):
         Return a set of group ids for the named button on the model.
         '''
         button_ids = self.search([
-                ('model', '=', model),
+                ('model.model', '=', model),
                 ('name', '=', name),
                 ])
         if not button_ids: