Techsystech
/
web_techsystech
forked from Techsystech/web
3
0
Fork 0
Code Pull Requests Activity

Merge pull request #310 from gurneyalex/7.0-unsafe-eval 

[SEC] web_dashboard_tile: fix unsafe eval
7.0
Pedro M. Baeza 2016-02-15 11:19:59 +01:00
parent b0677ca69a b19b6e95aa
commit 9ee9ddfbe9
2 changed files with 4 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
web_dashboard_tile/__openerp__.py
View File

@ -23,7 +23,7 @@
{ {
"name": "Dashboard Tile", "name": "Dashboard Tile",
"summary": "Add Tiles to Dashboard", "summary": "Add Tiles to Dashboard",
"version": "1.0", "version": "7.0.1.0.1",
"depends": [ "depends": [
'web', 'web',
'board', 'board',

5
web_dashboard_tile/tile.py
View File

@ -25,6 +25,7 @@
from openerp.osv import orm, fields from openerp.osv import orm, fields
from openerp.tools.translate import _ from openerp.tools.translate import _
from openerp.tools.safe_eval import safe_eval
class tile(orm.Model): class tile(orm.Model):
@ -55,7 +56,7 @@ class tile(orm.Model):
# Compute count item # Compute count item
model = self.pool.get(r.model_id.model) model = self.pool.get(r.model_id.model)
count = model.search_count( count = model.search_count(
cr, uid, eval(r.domain), context=context) cr, uid, safe_eval(r.domain), context=context)
res[r.id].update({ res[r.id].update({
'active': True, 'active': True,
'count': count, 'count': count,
@ -64,7 +65,7 @@ class tile(orm.Model):
# Compute datas for field_id depending of field_function # Compute datas for field_id depending of field_function
if r.field_function and r.field_id and count != 0: if r.field_function and r.field_id and count != 0:
ids = model.search( ids = model.search(
cr, uid, eval(r.domain), context=context) cr, uid, safe_eval(r.domain), context=context)
vals = [x[r.field_id.name] for x in model.read( vals = [x[r.field_id.name] for x in model.read(
cr, uid, ids, [r.field_id.name], context=context)] cr, uid, ids, [r.field_id.name], context=context)]
desc = r.field_id.field_description desc = r.field_id.field_description