diff --git a/addons/mail/controllers/discuss.py b/addons/mail/controllers/discuss.py index ece81f5f5f1..3d07c56fdb7 100644 --- a/addons/mail/controllers/discuss.py +++ b/addons/mail/controllers/discuss.py @@ -8,6 +8,7 @@ from psycopg2 import IntegrityError from psycopg2.errorcodes import UNIQUE_VIOLATION from odoo import http +from odoo.exceptions import UserError from odoo.http import request from odoo.tools import consteq, file_open from odoo.tools.misc import get_lang @@ -80,13 +81,21 @@ class DiscussController(http.Controller): channel_sudo = channel_partner_sudo.channel_id # ensure guest is in context else: if not channel_sudo.env.user._is_public(): - channel_sudo.add_members([channel_sudo.env.user.partner_id.id]) + try: + channel_sudo.add_members([channel_sudo.env.user.partner_id.id]) + except UserError: + raise NotFound() else: guest = channel_sudo.env['mail.guest']._get_guest_from_request(request) if guest: channel_sudo = channel_sudo.with_context(guest=guest) - channel_sudo.add_members(guest_ids=[guest.id]) + try: + channel_sudo.add_members(guest_ids=[guest.id]) + except UserError: + raise NotFound() else: + if channel_sudo.public == 'groups': + raise NotFound() guest = channel_sudo.env['mail.guest'].create({ 'country_id': channel_sudo.env['res.country'].search([('code', '=', request.session.get('geoip', {}).get('country_code'))], limit=1).id, 'lang': get_lang(channel_sudo.env).code, @@ -365,7 +374,10 @@ class DiscussController(http.Controller): # Do not add the guest to channel members if they are already member. if not channel_partner: channel_sudo = channel_sudo.with_context(guest=guest) - channel_sudo.add_members(guest_ids=[guest.id]) + try: + channel_sudo.add_members(guest_ids=[guest.id]) + except UserError: + raise NotFound() @http.route('/mail/channel/messages', methods=['POST'], type='json', auth='public') def mail_channel_messages(self, channel_id, max_id=None, min_id=None, limit=30, **kwargs): diff --git a/addons/mail/models/mail_channel.py b/addons/mail/models/mail_channel.py index 1d11d286a0f..2aaee5ca1a8 100644 --- a/addons/mail/models/mail_channel.py +++ b/addons/mail/models/mail_channel.py @@ -320,6 +320,13 @@ class Channel(models.Model): group_name=channel.group_public_id.name, partner_names=', '.join(partner.name for partner in invalid_partners) )) + if guests: + raise UserError(_( + 'Channel "%(channel_name)s" only accepts members of group "%(group_name)s". Forbidden for: %(guest_names)s', + channel_name=channel.name, + group_name=channel.group_public_id.name, + guest_names=', '.join(guest.name for guest in guests) + )) existing_partners = self.env['res.partner'].search([('id', 'in', partners.ids), ('channel_ids', 'in', channel.id)]) members_to_create += [{ 'partner_id': partner.id, diff --git a/addons/mail/tests/test_mail_channel_as_guest.py b/addons/mail/tests/test_mail_channel_as_guest.py index ac445252e7e..6315a6d94f1 100644 --- a/addons/mail/tests/test_mail_channel_as_guest.py +++ b/addons/mail/tests/test_mail_channel_as_guest.py @@ -11,5 +11,6 @@ class TestMailGuestPages(HttpCase): modules load correctly on the welcome and channel page""" channel = self.env['mail.channel'].create({ 'name': 'Test channel', + 'public': 'public', }) self.start_tour(f"/chat/{channel.id}/{channel.uuid}", "mail/static/tests/tours/mail_channel_as_guest_tour.js")