Version in base suite: 7.0.2-1 Base version: tryton-modules-company_7.0.2-1 Target version: tryton-modules-company_7.0.2-1+deb13u1 Base file: /srv/ftp-master.debian.org/ftp/pool/main/t/tryton-modules-company/tryton-modules-company_7.0.2-1.dsc Target file: /srv/ftp-master.debian.org/policy/pool/main/t/tryton-modules-company/tryton-modules-company_7.0.2-1+deb13u1.dsc changelog | 12 ++++++++++++ patches/01_manage_ModelAccessProxy.patch | 23 +++++++++++++++++++++++ patches/series | 1 + 3 files changed, 36 insertions(+) dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpvexq_lwx/tryton-modules-company_7.0.2-1.dsc: no acceptable signature found dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpvexq_lwx/tryton-modules-company_7.0.2-1+deb13u1.dsc: no acceptable signature found diff -Nru tryton-modules-company-7.0.2/debian/changelog tryton-modules-company-7.0.2/debian/changelog --- tryton-modules-company-7.0.2/debian/changelog 2025-01-02 13:50:08.000000000 +0000 +++ tryton-modules-company-7.0.2/debian/changelog 2026-09-02 13:45:09.000000000 +0000 @@ -1,3 +1,15 @@ +tryton-modules-company (7.0.2-1+deb13u1) trixie-security; urgency=high + + * Add 01_manage_ModelAccessProxy.patch. + This patch is part of the required patch adding ModelAccessProxy + https://foss.heptapod.net/tryton/tryton/-/merge_requests/3431 + needed for + From https://discuss.tryton.org/t/security-release-for-issue-14907: + Cédric Krier has discovered that access is not enforced when browsing + record instances in templates. + + -- Mathias Behrle Wed, 02 Sep 2026 15:45:09 +0200 + tryton-modules-company (7.0.2-1) unstable; urgency=medium * Merging upstream version 7.0.2. diff -Nru tryton-modules-company-7.0.2/debian/patches/01_manage_ModelAccessProxy.patch tryton-modules-company-7.0.2/debian/patches/01_manage_ModelAccessProxy.patch --- tryton-modules-company-7.0.2/debian/patches/01_manage_ModelAccessProxy.patch 1970-01-01 00:00:00.000000000 +0000 +++ tryton-modules-company-7.0.2/debian/patches/01_manage_ModelAccessProxy.patch 2026-09-02 13:40:51.000000000 +0000 @@ -0,0 +1,23 @@ +Description: ModelAccessProxy needed for "Enforce access rights on email template records" + From https://discuss.tryton.org/t/security-release-for-issue-14907: + Cédric Krier has discovered that access is not enforced when browsing + record instances in templates. + + This patch is part of the required patch adding ModelAccessProxy + https://foss.heptapod.net/tryton/tryton/-/merge_requests/3431 +Author: Cédric Krier +Last-Update: 2026-09-02 +Bug-Upstream: https://bugs.tryton.org/14907 +--- a/res.py ++++ b/res.py +@@ -193,6 +193,10 @@ + Return an ordered tuple of company ids for the user + ''' + transaction = Transaction() ++ ++ if '_companies' in transaction.context: ++ return transaction.context['_companies'] ++ + user_id = transaction.user + companies = cls._get_companies_cache.get(user_id) + if companies is not None: diff -Nru tryton-modules-company-7.0.2/debian/patches/series tryton-modules-company-7.0.2/debian/patches/series --- tryton-modules-company-7.0.2/debian/patches/series 1970-01-01 00:00:00.000000000 +0000 +++ tryton-modules-company-7.0.2/debian/patches/series 2026-09-02 13:35:54.000000000 +0000 @@ -0,0 +1 @@ +01_manage_ModelAccessProxy.patch