Fix search button clause in ModelButton.get_groups

CVE-2012-2238 issue2757 review478002 (transplanted from 2c147ff136c745e2e324f4d5db3107f8591ca228)
tryton · Sep 10, 2012 · 96cd5d5 · 96cd5d5
1 parent db1794c
commit 96cd5d5
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 1 deletion.
diff --git a/CHANGELOG b/CHANGELOG
@@ -1,3 +1,5 @@
+* Fix search button clause in ModelButton.get_groups (CVE-2012-2238)
+
 Version 2.4.1 - 2012-04-24
 * Restore es_AR translation
 

diff --git a/trytond/ir/model.py b/trytond/ir/model.py
@@ -522,7 +522,7 @@ def get_groups(self, model, name):
         Return a set of group ids for the named button on the model.
         '''
         button_ids = self.search([
-                ('model', '=', model),
+                ('model.model', '=', model),
                 ('name', '=', name),
                 ])
         if not button_ids: