[notification] avoid using InternalManager when we've got a CWUser

This will avoid potential information leak due to missed security restriction and is more compatible with legacy code (pb encountered in some client code).

Closes #10294761

authorSylvain Thénault <sylvain.thenault@logilab.fr>
changesetcf0db566cb35
branchdefault
phasedraft
hiddenyes
parent revision#42a4d52dc88d [views] fix ProcessInformationView: SESSION_MANAGER can be None (closes #5753280)
child revision<not specified>
files modified by this revision
sobjects/notification.py
sobjects/test/unittest_notification.py
# HG changeset patch
# User Sylvain Thénault <sylvain.thenault@logilab.fr>
# Date 1453827840 -3600
# Tue Jan 26 18:04:00 2016 +0100
# Node ID cf0db566cb350ca5d28b82ab1fee862815ca06c3
# Parent 42a4d52dc88d88cd4dc5443fcba66eecef09f1d7
[notification] avoid using InternalManager when we've got a CWUser

This will avoid potential information leak due to missed security restriction
and is more compatible with legacy code (pb encountered in some client code).

Closes #10294761

diff --git a/sobjects/notification.py b/sobjects/notification.py
@@ -46,13 +46,11 @@
1 
2      def recipients(self):
3          mode = self._cw.vreg.config['default-recipients-mode']
4          if mode == 'users':
5              execute = self._cw.execute
6 -            dests = [(u.cw_adapt_to('IEmailable').get_email(),
7 -                      u.property_value('ui.language'))
8 -                     for u in execute(self.user_rql, build_descr=True).entities()]
9 +            dests = list(execute(self.user_rql, build_descr=True).entities())
10          elif mode == 'default-dest-addrs':
11              lang = self._cw.vreg.property_value('ui.language')
12              dests = zip(self._cw.vreg.config['default-dest-addrs'], repeat(lang))
13          else: # mode == 'none'
14              dests = []
diff --git a/sobjects/test/unittest_notification.py b/sobjects/test/unittest_notification.py
@@ -71,11 +71,11 @@
15              finder = self.vreg['components'].select('recipients_finder',
16                                                      req, rset=urset)
17              self.set_option('default-recipients-mode', 'none')
18              self.assertEqual(finder.recipients(), [])
19              self.set_option('default-recipients-mode', 'users')
20 -            self.assertEqual(finder.recipients(), [(u'admin@logilab.fr', 'fr')])
21 +            self.assertEqual(finder.recipients(), [req.user])
22              self.set_option('default-recipients-mode', 'default-dest-addrs')
23              self.set_option('default-dest-addrs', 'abcd@logilab.fr, efgh@logilab.fr')
24              self.assertEqual(finder.recipients(), [('abcd@logilab.fr', 'en'), ('efgh@logilab.fr', 'en')])
25 
26      def test_status_change_view(self):