[tryton-debian-vcs] tryton-server branch debian-jessie-3.2 updated. debian/3.2.10-1-2-gda363e4

[Mathias Behrle]

The following commit has been merged in the debian-jessie-3.2 branch:
https://alioth.debian.org/plugins/scmgit/cgi-bin/gitweb.cgi/?p=tryton/tryton-server.git;a=commitdiff;h=debian/3.2.10-1-2-gda363e4

commit da363e45f3610a01bbf8e9645638e94e596500bb
Author: Mathias Behrle <mathiasb at m9s.biz>
Date:   Wed Dec 16 15:29:07 2015 +0100

    Releasing debian version 3.2.11-1.
    
    Signed-off-by: Mathias Behrle <mathiasb at m9s.biz>

diff --git a/debian/changelog b/debian/changelog
index 9bcb90d..76590cc 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,12 @@
+tryton-server (3.2.11-1) unstable; urgency=high
+
+  * Merging upstream version 3.2.11.
+  * Fix for CVE-2015-0861 field access on multi write.
+    https://bugs.tryton.org/issue5167
+    https://codereview.tryton.org/22631002
+
+ -- Mathias Behrle <mathiasb at m9s.biz>  Wed, 16 Dec 2015 15:29:07 +0100
+
 tryton-server (3.2.10-1) unstable; urgency=medium
 
   * Merging upstream version 3.2.10.
commit 3df30145f8db65422d4e6b66876df40f6dbcdbc6
Author: Mathias Behrle <mathiasb at m9s.biz>
Date:   Wed Dec 16 15:29:07 2015 +0100

    Merging upstream version 3.2.11.

diff --git a/CHANGELOG b/CHANGELOG
index 3c766d7..e07a090 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -1,3 +1,7 @@
+Version 3.2.11 - 2015-12-16
+* Bug fixes (see mercurial logs for details)
+* Check all fields when writing a sequence of records, values (CVE-2015-0861)
+
 Version 3.2.10 - 2015-11-09
 * Bug fixes (see mercurial logs for details)
 
diff --git a/PKG-INFO b/PKG-INFO
index 901d0c6..9b321c7 100644
--- a/PKG-INFO
+++ b/PKG-INFO
@@ -1,6 +1,6 @@
 Metadata-Version: 1.1
 Name: trytond
-Version: 3.2.10
+Version: 3.2.11
 Summary: Tryton server
 Home-page: http://www.tryton.org/
 Author: Tryton
diff --git a/trytond.egg-info/PKG-INFO b/trytond.egg-info/PKG-INFO
index 901d0c6..9b321c7 100644
--- a/trytond.egg-info/PKG-INFO
+++ b/trytond.egg-info/PKG-INFO
@@ -1,6 +1,6 @@
 Metadata-Version: 1.1
 Name: trytond
-Version: 3.2.10
+Version: 3.2.11
 Summary: Tryton server
 Home-page: http://www.tryton.org/
 Author: Tryton
diff --git a/trytond/model/modelstorage.py b/trytond/model/modelstorage.py
index 358f9c9..93c8ee1 100644
--- a/trytond/model/modelstorage.py
+++ b/trytond/model/modelstorage.py
@@ -138,18 +138,19 @@ class ModelStorage(Model):
         ModelAccess = pool.get('ir.model.access')
         ModelFieldAccess = pool.get('ir.model.field.access')
 
-        ModelAccess.check(cls.__name__, 'write')
-        ModelFieldAccess.check(cls.__name__,
-            [x for x in values if x in cls._fields], 'write')
-
         assert not len(args) % 2
         actions = iter((records, values) + args)
         all_records = []
+        all_fields = set()
         for records, values in zip(actions, actions):
             if not cls.check_xml_record(records, values):
                 cls.raise_user_error('write_xml_record',
                         error_description='xml_record_desc')
             all_records += records
+            all_fields.update(values.iterkeys())
+
+        ModelAccess.check(cls.__name__, 'write')
+        ModelFieldAccess.check(cls.__name__, all_fields, 'write')
 
         # Increase transaction counter
         Transaction().counter += 1
diff --git a/trytond/version.py b/trytond/version.py
index 5bafe45..0ddedca 100644
--- a/trytond/version.py
+++ b/trytond/version.py
@@ -1,6 +1,6 @@
 #This file is part of Tryton.  The COPYRIGHT file at the top level of
 #this repository contains the full copyright notices and license terms.
 PACKAGE = "trytond"
-VERSION = "3.2.10"
+VERSION = "3.2.11"
 LICENSE = "GPL-3"
 WEBSITE = "http://www.tryton.org/"
-- 
tryton-server