From 1b7fb828e0c909e9a6c4c5a2c119fc28b7eaee53 Mon Sep 17 00:00:00 2001
From: "Didier (did)" <did@odoo.com>
Date: Mon, 28 Feb 2022 08:35:50 +0000
Subject: [PATCH] [FIX] mail: allow user to delete other's attachments again
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Before this PR, only author of the message and admin could delete attachments
inside the chatter.
This behavior is now restricted to the channels and allow users to delete
attachments inside the chatter.

task-2753295

closes odoo/odoo#86302

X-original-commit: 5934dc08b32b422a11324743148083d4daa34350
Signed-off-by: Sébastien Theys (seb) <seb@odoo.com>
---
 addons/mail/controllers/discuss.py                     |  4 +++-
 .../src/components/message/tests/message_tests.js      |  6 +++++-
 addons/mail/static/src/models/attachment/attachment.js | 10 ++++++----
 3 files changed, 14 insertions(+), 6 deletions(-)

diff --git a/addons/mail/controllers/discuss.py b/addons/mail/controllers/discuss.py
index c824844328b..ece81f5f5f1 100644
--- a/addons/mail/controllers/discuss.py
+++ b/addons/mail/controllers/discuss.py
@@ -268,7 +268,9 @@ class DiscussController(http.Controller):
     def mail_attachment_delete(self, attachment_id, access_token=None, **kwargs):
         attachment_sudo = request.env['ir.attachment'].browse(int(attachment_id)).sudo().exists()
         if not attachment_sudo:
-            raise NotFound()
+            target = request.env.user.partner_id
+            request.env['bus.bus']._sendone(target, 'ir.attachment/delete', {'id': attachment_id})
+            return
         if not request.env.user.share:
             # Check through standard access rights/rules for internal users.
             attachment_sudo.sudo(False)._delete_and_notify()
diff --git a/addons/mail/static/src/components/message/tests/message_tests.js b/addons/mail/static/src/components/message/tests/message_tests.js
index 3e9b43bf14a..7bfe385c2d4 100644
--- a/addons/mail/static/src/components/message/tests/message_tests.js
+++ b/addons/mail/static/src/components/message/tests/message_tests.js
@@ -701,7 +701,7 @@ QUnit.test('allow attachment delete on authored message', async function (assert
     );
 });
 
-QUnit.test('prevent attachment delete on non-authored message', async function (assert) {
+QUnit.test('prevent attachment delete on non-authored message in channels', async function (assert) {
     assert.expect(2);
 
     const { createMessageComponent } = await this.start();
@@ -711,6 +711,10 @@ QUnit.test('prevent attachment delete on non-authored message', async function (
             id: 10,
             name: "BLAH",
             mimetype: 'image/jpeg',
+            originThread: insertAndReplace({
+                id: 11,
+                model: 'mail.channel',
+            }),
         }),
         author: insert({ id: 11, display_name: "Guy" }),
         body: "<p>Test</p>",
diff --git a/addons/mail/static/src/models/attachment/attachment.js b/addons/mail/static/src/models/attachment/attachment.js
index 56c167c0c90..9ccc5a25bb2 100644
--- a/addons/mail/static/src/models/attachment/attachment.js
+++ b/addons/mail/static/src/models/attachment/attachment.js
@@ -164,13 +164,15 @@ registerModel({
             if (!this.messaging) {
                 return;
             }
-            return this.messages.length
-                ? this.messages.some(message => (
+
+            if (this.messages.length && this.originThread && this.originThread.model === 'mail.channel') {
+                return this.messages.some(message => (
                     message.canBeDeleted ||
                     (message.author && message.author === this.messaging.currentPartner) ||
                     (message.guestAuthor && message.guestAuthor === this.messaging.currentGuest)
-                ))
-                : true;
+                ));
+            }
+            return true;
         },
         /**
          * @private