From c808170bc8102d8d3f832693b8b5ba437d1e0bd2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Dar=C3=ADo=20Lodeiros?= Date: Sun, 31 Jan 2021 10:10:56 +0100 Subject: [PATCH] [IMP]pms: get_active_properties overwrite cookies --- pms/models/res_users.py | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/pms/models/res_users.py b/pms/models/res_users.py index 2a4123127..9ca390e3e 100644 --- a/pms/models/res_users.py +++ b/pms/models/res_users.py @@ -1,7 +1,6 @@ # Copyright 2019 Pablo Quesada # License AGPL-3.0 or later (http://www.gnu.org/licenses/agpl). -from odoo import _, api, fields, models -from odoo.exceptions import AccessError +from odoo import api, fields, models from odoo.http import request @@ -39,7 +38,8 @@ class ResUsers(models.Model): active_property_ids = list( map(int, request.httprequest.cookies.get("pms_pids", "").split(",")) ) - if any(pid not in user_property_ids for pid in active_property_ids): - raise AccessError(_("Access to unauthorized or invalid properties.")) + active_property_ids = [ + pid for pid in active_property_ids if pid in user_property_ids + ] return self.env["pms.property"].browse(active_property_ids).ids return user_property_ids