From 0ec39e91e570a5209d133c5571cd730a01fe550a Mon Sep 17 00:00:00 2001 From: Jeremy Kersten Date: Thu, 8 Feb 2024 12:11:15 +0100 Subject: [PATCH] [FIX] mail, hr_recruitment: fix creation of alias for source A user that is not admin cannot create an mail.alias. We can create the alias in sudo since we control the default_values and model that are created with the new alias. Check the _check_alias_domain_id_mc constraint in sudo because non amdin user cannot read model ir.model. closes odoo/odoo#153222 Signed-off-by: Olivier Dony (odo) --- addons/hr_recruitment/models/hr_recruitment_source.py | 6 +++++- addons/mail/models/mail_alias.py | 4 +++- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/addons/hr_recruitment/models/hr_recruitment_source.py b/addons/hr_recruitment/models/hr_recruitment_source.py index 7e10819ba4e..20c63faedbc 100644 --- a/addons/hr_recruitment/models/hr_recruitment_source.py +++ b/addons/hr_recruitment/models/hr_recruitment_source.py @@ -40,7 +40,11 @@ class RecruitmentSource(models.Model): 'alias_parent_thread_id': source.job_id.id, 'alias_parent_model_id': self.env['ir.model']._get_id('hr.job'), } - source.alias_id = self.env['mail.alias'].create(vals) + + # check that you can create source before to call mail.alias in sudo with known/controlled vals + source.check_access_rights('create') + source.check_access_rule('create') + source.alias_id = self.env['mail.alias'].sudo().create(vals) def unlink(self): """ Cascade delete aliases to avoid useless / badly configured aliases. """ diff --git a/addons/mail/models/mail_alias.py b/addons/mail/models/mail_alias.py index f436d5c1453..373ec77bd51 100644 --- a/addons/mail/models/mail_alias.py +++ b/addons/mail/models/mail_alias.py @@ -108,7 +108,9 @@ class Alias(models.Model): """ Check for invalid alias domains based on company configuration. When having a parent record and/or updating an existing record alias domain should match the one used on the related record. """ - tocheck = self.filtered(lambda domain: domain.alias_domain_id.company_ids) + + # in sudo, to be able to read alias_parent_model_id (ir.model) + tocheck = self.sudo().filtered(lambda domain: domain.alias_domain_id.company_ids) if not tocheck: return