Version in base suite: 7.0.1-1 Base version: tryton-modules-marketing-automation_7.0.1-1 Target version: tryton-modules-marketing-automation_7.0.1-1deb13u1 Base file: /srv/ftp-master.debian.org/ftp/pool/main/t/tryton-modules-marketing-automation/tryton-modules-marketing-automation_7.0.1-1.dsc Target file: /srv/ftp-master.debian.org/policy/pool/main/t/tryton-modules-marketing-automation/tryton-modules-marketing-automation_7.0.1-1deb13u1.dsc changelog | 13 + patches/01_enforce_access_rights_on_the_email_template_record_of_marketing_automation.patch | 99 ++++++++++ patches/series | 1 3 files changed, 113 insertions(+) dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpm5qn7j91/tryton-modules-marketing-automation_7.0.1-1.dsc: no acceptable signature found dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpm5qn7j91/tryton-modules-marketing-automation_7.0.1-1deb13u1.dsc: no acceptable signature found diff -Nru tryton-modules-marketing-automation-7.0.1/debian/changelog tryton-modules-marketing-automation-7.0.1/debian/changelog --- tryton-modules-marketing-automation-7.0.1/debian/changelog 2025-01-21 10:11:24.000000000 +0000 +++ tryton-modules-marketing-automation-7.0.1/debian/changelog 2026-09-02 14:25:07.000000000 +0000 @@ -1,3 +1,16 @@ +tryton-modules-marketing-automation (7.0.1-1deb13u1) trixie-security; urgency=high + + * Add 01_enforce_access_rights_on_the_email_template_record_of_marketing + _automation.patch. + + From https://discuss.tryton.org/t/security-release-for-issue-14907: + Cédric Krier has discovered that access is not enforced when browsing + record instances in templates. + This patch also neeeds ModelAccessProxy + https://foss.heptapod.net/tryton/tryton/-/merge_requests/3431 + + -- Mathias Behrle Wed, 02 Sep 2026 16:25:07 +0200 + tryton-modules-marketing-automation (7.0.1-1) unstable; urgency=medium * Merging upstream version 7.0.1. diff -Nru tryton-modules-marketing-automation-7.0.1/debian/patches/01_enforce_access_rights_on_the_email_template_record_of_marketing_automation.patch tryton-modules-marketing-automation-7.0.1/debian/patches/01_enforce_access_rights_on_the_email_template_record_of_marketing_automation.patch --- tryton-modules-marketing-automation-7.0.1/debian/patches/01_enforce_access_rights_on_the_email_template_record_of_marketing_automation.patch 1970-01-01 00:00:00.000000000 +0000 +++ tryton-modules-marketing-automation-7.0.1/debian/patches/01_enforce_access_rights_on_the_email_template_record_of_marketing_automation.patch 2026-09-02 14:25:07.000000000 +0000 @@ -0,0 +1,99 @@ +Description: Enforce access rights on email template records + From https://discuss.tryton.org/t/security-release-for-issue-14907: + Cédric Krier has discovered that access is not enforced when browsing + record instances in templates. + + This patch also neeeds ModelAccessProxy + https://foss.heptapod.net/tryton/tryton/-/merge_requests/3431 +Author: Cédric Krier +Last-Update: 2026-09-02 +Bug-Upstream: https://bugs.tryton.org/14907 + +--- b/marketing_automation.py ++++ b/marketing_automation.py +@@ -25,8 +25,8 @@ + from trytond.config import config + from trytond.i18n import gettext + from trytond.model import ( +- EvalEnvironment, Index, ModelSQL, ModelView, Unique, Workflow, dualmethod, +- fields) ++ EvalEnvironment, Index, ModelAccessProxy, ModelSQL, ModelView, Unique, ++ Workflow, dualmethod, fields) + from trytond.pool import Pool + from trytond.pyson import Eval, If, PYSONDecoder, TimeDelta + from trytond.report import Report +@@ -37,6 +37,11 @@ + from trytond.url import http_host + from trytond.wsgi import Base64Converter + ++try: ++ from trytond.model import ModelAccessProxy ++except ImportError: ++ ModelAccessProxy = None ++ + from .exceptions import ConditionError, DomainError, TemplateError + from .mixin import MarketingAutomationMixin + +@@ -632,8 +637,13 @@ + email.save() + + def email_context(self, record): ++ if ModelAccessProxy: ++ record = ModelAccessProxy( ++ record.record, record.record.marketing_access_context) ++ else: ++ record = record.record + return { +- 'record': record.record, ++ 'record': record, + 'format_date': Report.format_date, + 'format_datetime': Report.format_datetime, + 'format_timedelta': Report.format_timedelta, +--- a/mixin.py ++++ b/mixin.py +@@ -2,6 +2,7 @@ + # this repository contains the full copyright notices and license terms. + + from trytond.model import fields ++from trytond.pool import Pool + + + class MarketingAutomationMixin: +@@ -17,3 +18,11 @@ + @classmethod + def search_marketing_party(cls, name, clause): + raise NotImplementedError ++ ++ @property ++ def marketing_access_context(self): ++ pool = Pool() ++ ModelData = pool.get('ir.model.data') ++ return { ++ '_groups': [ModelData.get_id('marketing.group_marketing')], ++ } +--- a/sale.py ++++ b/sale.py +@@ -1,7 +1,7 @@ + # This file is part of Tryton. The COPYRIGHT file at the top level of + # this repository contains the full copyright notices and license terms. + +-from trytond.pool import PoolMeta ++from trytond.pool import Pool, PoolMeta + + from .mixin import MarketingAutomationMixin + +@@ -16,3 +16,14 @@ + def search_marketing_party(cls, name, clause): + nested = clause[0][len(name):] + return [('party' + nested, *clause[1:])] ++ ++ @property ++ def marketing_access_context(self): ++ pool = Pool() ++ ModelData = pool.get('ir.model.data') ++ context = super().marketing_access_context ++ context.setdefault('_groups', []).append( ++ ModelData.get_id('sale.group_sale')) ++ context.setdefault('_companies', []).append( ++ self.company.id) ++ return context diff -Nru tryton-modules-marketing-automation-7.0.1/debian/patches/series tryton-modules-marketing-automation-7.0.1/debian/patches/series --- tryton-modules-marketing-automation-7.0.1/debian/patches/series 1970-01-01 00:00:00.000000000 +0000 +++ tryton-modules-marketing-automation-7.0.1/debian/patches/series 2026-09-02 14:05:16.000000000 +0000 @@ -0,0 +1 @@ +01_enforce_access_rights_on_the_email_template_record_of_marketing_automation.patch