From 1043c6c65c296a5f6c3b697c6dd797af83cda4a8 Mon Sep 17 00:00:00 2001
From: Ipsita Borisagar <ibo@odoo.com>
Date: Tue, 16 Nov 2021 12:50:27 +0000
Subject: [PATCH] [FIX] mail: do not allow guests for group restricted channels
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Before this commit:

When user shares the invitation link of the channel(groups restricted), guests
are allowed to access it.

After this commit:

Guests will not be allowed to access channels that are restricted to groups.

Task-2679184

closes odoo/odoo#87004

X-original-commit: ea3232c111546ec636f543db912bf0e2a7ed345b
Signed-off-by: Sébastien Theys (seb) <seb@odoo.com>
---
 addons/mail/controllers/discuss.py             | 18 +++++++++++++++---
 addons/mail/models/mail_channel.py             |  7 +++++++
 .../mail/tests/test_mail_channel_as_guest.py   |  1 +
 3 files changed, 23 insertions(+), 3 deletions(-)

diff --git a/addons/mail/controllers/discuss.py b/addons/mail/controllers/discuss.py
index ece81f5f5f1..3d07c56fdb7 100644
--- a/addons/mail/controllers/discuss.py
+++ b/addons/mail/controllers/discuss.py
@@ -8,6 +8,7 @@ from psycopg2 import IntegrityError
 from psycopg2.errorcodes import UNIQUE_VIOLATION
 
 from odoo import http
+from odoo.exceptions import UserError
 from odoo.http import request
 from odoo.tools import consteq, file_open
 from odoo.tools.misc import get_lang
@@ -80,13 +81,21 @@ class DiscussController(http.Controller):
             channel_sudo = channel_partner_sudo.channel_id  # ensure guest is in context
         else:
             if not channel_sudo.env.user._is_public():
-                channel_sudo.add_members([channel_sudo.env.user.partner_id.id])
+                try:
+                    channel_sudo.add_members([channel_sudo.env.user.partner_id.id])
+                except UserError:
+                    raise NotFound()
             else:
                 guest = channel_sudo.env['mail.guest']._get_guest_from_request(request)
                 if guest:
                     channel_sudo = channel_sudo.with_context(guest=guest)
-                    channel_sudo.add_members(guest_ids=[guest.id])
+                    try:
+                        channel_sudo.add_members(guest_ids=[guest.id])
+                    except UserError:
+                        raise NotFound()
                 else:
+                    if channel_sudo.public == 'groups':
+                        raise NotFound()
                     guest = channel_sudo.env['mail.guest'].create({
                         'country_id': channel_sudo.env['res.country'].search([('code', '=', request.session.get('geoip', {}).get('country_code'))], limit=1).id,
                         'lang': get_lang(channel_sudo.env).code,
@@ -365,7 +374,10 @@ class DiscussController(http.Controller):
         # Do not add the guest to channel members if they are already member.
         if not channel_partner:
             channel_sudo = channel_sudo.with_context(guest=guest)
-            channel_sudo.add_members(guest_ids=[guest.id])
+            try:
+                channel_sudo.add_members(guest_ids=[guest.id])
+            except UserError:
+                raise NotFound()
 
     @http.route('/mail/channel/messages', methods=['POST'], type='json', auth='public')
     def mail_channel_messages(self, channel_id, max_id=None, min_id=None, limit=30, **kwargs):
diff --git a/addons/mail/models/mail_channel.py b/addons/mail/models/mail_channel.py
index 1d11d286a0f..2aaee5ca1a8 100644
--- a/addons/mail/models/mail_channel.py
+++ b/addons/mail/models/mail_channel.py
@@ -320,6 +320,13 @@ class Channel(models.Model):
                         group_name=channel.group_public_id.name,
                         partner_names=', '.join(partner.name for partner in invalid_partners)
                     ))
+                if guests:
+                    raise UserError(_(
+                        'Channel "%(channel_name)s" only accepts members of group "%(group_name)s". Forbidden for: %(guest_names)s',
+                        channel_name=channel.name,
+                        group_name=channel.group_public_id.name,
+                        guest_names=', '.join(guest.name for guest in guests)
+                    ))
             existing_partners = self.env['res.partner'].search([('id', 'in', partners.ids), ('channel_ids', 'in', channel.id)])
             members_to_create += [{
                 'partner_id': partner.id,
diff --git a/addons/mail/tests/test_mail_channel_as_guest.py b/addons/mail/tests/test_mail_channel_as_guest.py
index ac445252e7e..6315a6d94f1 100644
--- a/addons/mail/tests/test_mail_channel_as_guest.py
+++ b/addons/mail/tests/test_mail_channel_as_guest.py
@@ -11,5 +11,6 @@ class TestMailGuestPages(HttpCase):
         modules load correctly on the welcome and channel page"""
         channel = self.env['mail.channel'].create({
             'name': 'Test channel',
+            'public': 'public',
         })
         self.start_tour(f"/chat/{channel.id}/{channel.uuid}", "mail/static/tests/tours/mail_channel_as_guest_tour.js")