From 0d8222c7c8b5d858f86fa88d4645fa3306bd65d5 Mon Sep 17 00:00:00 2001
From: Romain Derie <rde@odoo.com>
Date: Mon, 26 Dec 2022 13:29:10 +0000
Subject: [PATCH] [FIX] website: prevent crash for non admin publisher when
 click on form

When editing a website form, a `search_read` request is fired on
`ir.model` model to get the list of possible form actions (create
ticket, create opportunity, etc.).
But since commit [1] in Odoo 15, non-admin users don't have read access
anymore on this model, leading to a traceback when clicking on a form in
edit mode.

Steps to reproduce (as designer):
- Install only website and login as admin
- Make "portal" user an internal user and give him "Editor and Designer"
  rights
- Login as "portal" user
- Enter edit mode on any page and drag & drop the form snippet, or
  simply go to /contactus page which already has one
- Click on the form -> Traceback

Steps to reproduce (as publisher/restricted editor):
- Install website_hr_recruitment
- Make "portal" user an internal user and give him the following rights:
  - Website: Restricted Editor
  - Recruitment: Administrator
- Login as "portal" user
- Go to a job page like /jobs/detail/experienced-developer-4
- Enter edit mode and drag & drop the form snippet
- It will crash

[1]: https://github.com/odoo/odoo/commit/5dc4cff60a557e14b08440c227423291c407899b

opw-3098097
opw-3101884

closes odoo/odoo#109339

X-original-commit: 054c216e93b818794316bfd4b8ce56d6853a61d3
Signed-off-by: Romain Derie (rde) <rde@odoo.com>
Signed-off-by: Quentin Smetz (qsm) <qsm@odoo.com>
---
 addons/website/models/website_form.py                    | 9 +++++++++
 .../static/src/snippets/s_website_form/options.js        | 8 ++------
 2 files changed, 11 insertions(+), 6 deletions(-)

diff --git a/addons/website/models/website_form.py b/addons/website/models/website_form.py
index 28bb2674ce4..b7a6ee295fe 100644
--- a/addons/website/models/website_form.py
+++ b/addons/website/models/website_form.py
@@ -68,6 +68,15 @@ class website_form_model(models.Model):
 
         return fields_get
 
+    @api.model
+    def get_compatible_form_models(self):
+        if not self.env.user.has_group('website.group_website_restricted_editor'):
+            return []
+        return self.sudo().search_read(
+            [('website_form_access', '=', True)],
+            ['id', 'model', 'name', 'website_form_label', 'website_form_key'],
+        )
+
 
 class website_form_model_fields(models.Model):
     """ fields configuration for form builder """
diff --git a/addons/website/static/src/snippets/s_website_form/options.js b/addons/website/static/src/snippets/s_website_form/options.js
index 452fb0ff6f3..6a9e800bf73 100644
--- a/addons/website/static/src/snippets/s_website_form/options.js
+++ b/addons/website/static/src/snippets/s_website_form/options.js
@@ -305,12 +305,8 @@ options.registry.WebsiteFormEditor = FormEditor.extend({
 
         // Get list of website_form compatible models.
         this.models = await this._rpc({
-            model: "ir.model",
-            method: "search_read",
-            args: [
-                [['website_form_access', '=', true]],
-                ['id', 'model', 'name', 'website_form_label', 'website_form_key']
-            ],
+            model: 'ir.model',
+            method: 'get_compatible_form_models',
         });
 
         const targetModelName = this.$target[0].dataset.model_name || 'mail.mail';