From 19a8bf95274b401e4a7208d11b64f16e3529a2f5 Mon Sep 17 00:00:00 2001 From: "Xavier BOL (xbo)" Date: Thu, 5 Aug 2021 17:44:53 +0200 Subject: [PATCH] [IMP] project: check portal user can access to project sharing chatter Before this commit, when we change the access right to the portal user and this user is in task form view with chatter. He can send message even we remove the access right. This commit checks if the user has the access before sending the message. task-2379518 --- addons/project/controllers/project_sharing_chatter.py | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/addons/project/controllers/project_sharing_chatter.py b/addons/project/controllers/project_sharing_chatter.py index 77f3145e52f..c29123bb216 100644 --- a/addons/project/controllers/project_sharing_chatter.py +++ b/addons/project/controllers/project_sharing_chatter.py @@ -7,6 +7,7 @@ from odoo.http import request, route from odoo.tools import consteq from odoo.addons.portal.controllers.mail import PortalChatter +from .portal import ProjectCustomerPortal class ProjectSharingChatter(PortalChatter): @@ -21,8 +22,8 @@ class ProjectSharingChatter(PortalChatter): If we do not have any token, then we need to check if the portal user is a follower of the project shared. If it is the case, then we give the access token of the task. """ - project_sudo = request.env['project.project'].browse(project_id).sudo() - can_access = project_sudo and res_model == 'project.task' and res_id in project_sudo.tasks.ids + project_sudo = ProjectCustomerPortal._document_check_access(self, 'project.project', project_id, token) + can_access = project_sudo and res_model == 'project.task' and project_sudo.with_user(request.env.user)._check_project_sharing_access('comment') if token: can_access &= consteq(project_sudo.access_token, token) else: