[FIX] mail: do not allow guests for group restricted channels

Before this commit:

When user shares the invitation link of the channel(groups restricted), guests
are allowed to access it.

After this commit:

Guests will not be allowed to access channels that are restricted to groups.

Task-2679184

closes odoo/odoo#87004

X-original-commit: ea3232c111546ec636f543db912bf0e2a7ed345b
Signed-off-by: Sébastien Theys (seb) <seb@odoo.com>

addons/mail/controllers/discuss.py

@@ -8,6 +8,7 @@ from psycopg2 import IntegrityError
 from psycopg2.errorcodes import UNIQUE_VIOLATION
 
 from odoo import http
+from odoo.exceptions import UserError
 from odoo.http import request
 from odoo.tools import consteq, file_open
 from odoo.tools.misc import get_lang
@@ -80,13 +81,21 @@ class DiscussController(http.Controller):
             channel_sudo = channel_partner_sudo.channel_id  # ensure guest is in context
         else:
             if not channel_sudo.env.user._is_public():
-                channel_sudo.add_members([channel_sudo.env.user.partner_id.id])
+                try:
+                    channel_sudo.add_members([channel_sudo.env.user.partner_id.id])
+                except UserError:
+                    raise NotFound()
             else:
                 guest = channel_sudo.env['mail.guest']._get_guest_from_request(request)
                 if guest:
                     channel_sudo = channel_sudo.with_context(guest=guest)
-                    channel_sudo.add_members(guest_ids=[guest.id])
+                    try:
+                        channel_sudo.add_members(guest_ids=[guest.id])
+                    except UserError:
+                        raise NotFound()
                 else:
+                    if channel_sudo.public == 'groups':
+                        raise NotFound()
                     guest = channel_sudo.env['mail.guest'].create({
                         'country_id': channel_sudo.env['res.country'].search([('code', '=', request.session.get('geoip', {}).get('country_code'))], limit=1).id,
                         'lang': get_lang(channel_sudo.env).code,
@@ -365,7 +374,10 @@ class DiscussController(http.Controller):
         # Do not add the guest to channel members if they are already member.
         if not channel_partner:
             channel_sudo = channel_sudo.with_context(guest=guest)
-            channel_sudo.add_members(guest_ids=[guest.id])
+            try:
+                channel_sudo.add_members(guest_ids=[guest.id])
+            except UserError:
+                raise NotFound()
 
     @http.route('/mail/channel/messages', methods=['POST'], type='json', auth='public')
     def mail_channel_messages(self, channel_id, max_id=None, min_id=None, limit=30, **kwargs):

addons/mail/models/mail_channel.py

@@ -320,6 +320,13 @@ class Channel(models.Model):
                         group_name=channel.group_public_id.name,
                         partner_names=', '.join(partner.name for partner in invalid_partners)
                     ))
+                if guests:
+                    raise UserError(_(
+                        'Channel "%(channel_name)s" only accepts members of group "%(group_name)s". Forbidden for: %(guest_names)s',
+                        channel_name=channel.name,
+                        group_name=channel.group_public_id.name,
+                        guest_names=', '.join(guest.name for guest in guests)
+                    ))
             existing_partners = self.env['res.partner'].search([('id', 'in', partners.ids), ('channel_ids', 'in', channel.id)])
             members_to_create += [{
                 'partner_id': partner.id,

addons/mail/tests/test_mail_channel_as_guest.py

@@ -11,5 +11,6 @@ class TestMailGuestPages(HttpCase):
         modules load correctly on the welcome and channel page"""
         channel = self.env['mail.channel'].create({
             'name': 'Test channel',
+            'public': 'public',
         })
         self.start_tour(f"/chat/{channel.id}/{channel.uuid}", "mail/static/tests/tours/mail_channel_as_guest_tour.js")