Don't allow rpc call on ModelStorage without ModelView

CVE-2012-0215 issue2476 review303001
tryton · Mar 28, 2012 · d059ebb · d059ebb
1 parent e7b1f97
commit d059ebb
Show file tree

Hide file tree

Showing 2 changed files with 15 additions and 12 deletions.
diff --git a/CHANGELOG b/CHANGELOG
@@ -1,3 +1,4 @@
+* Don't allow rpc call on ModelStorage without ModelView (CVE-2012-0215)
 * Add shared WebDAV
 * Remove workflow module
 * Simplify workflow engine

diff --git a/trytond/model/modelstorage.py b/trytond/model/modelstorage.py
@@ -26,6 +26,7 @@
 from trytond.pool import Pool
 from trytond.cache import LRUDict
 from trytond.config import CONFIG
+from .modelview import ModelView
 
 
 class ModelStorage(Model):
@@ -42,18 +43,19 @@ class ModelStorage(Model):
 
     def __init__(self):
         super(ModelStorage, self).__init__()
-        self._rpc.update({
-            'create': True,
-            'read': False,
-            'write': True,
-            'delete': True,
-            'copy': True,
-            'search': False,
-            'search_count': False,
-            'search_read': False,
-            'export_data': False,
-            'import_data': True,
-        })
+        if isinstance(self, ModelView):
+            self._rpc.update({
+                'create': True,
+                'read': False,
+                'write': True,
+                'delete': True,
+                'copy': True,
+                'search': False,
+                'search_count': False,
+                'search_read': False,
+                'export_data': False,
+                'import_data': True,
+            })
         self._constraints = []
 
     def default_create_uid(self):