pengyuthon/odoo_source
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[FIX] website_mail_channel: let portal readers access attachments

Browse Source 
As reading attachments is not possible for portal users displaying a
message in mailing list frontend crashes if there is any attachment linked
to the message. Moreover downloading it would be impossible as access is
not granted.

In this commit we display attachments as sudo. Indeed if current portal user
has access to the message he should be able to access its attachments as they
are part of it. Moreover missing access tokens are generated on the fly to
enable download of attachments.

LINKS

Task ID-2070632 (main task)
Task ID-2419762 (followup task)
COM PR odoo/odoo#62859
ENT PR odoo/enterprise#15172
UPG PR odoo/upgrade#2005
This commit is contained in:
Thibault Delavallée
2021-03-17 18:06:49 +00:00
parent 31abe454b9
commit 1d21bb4bcb
2 changed files with 27 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
addons/website_mail_channel/controllers/main.py
+11
View File
@@ -175,8 +175,19 @@ class MailGroup(http.Controller):
base_domain = [('model', '=', 'mail.channel'), ('res_id', '=', group.id)]
next_message = Message.search(base_domain + [('date', '<', message.date)], order="date DESC", limit=1) or None
prev_message = Message.search(base_domain + [('date', '>', message.date)], order="date", limit=1) or None
# handle access to attachments for public / portal
if request.env.user.has_group('base.group_user'):
attachments = message.attachment_ids
else:
# portal / external people cannot access attachments -> grant access
# as message is ok, generate access tokens
attachments = message.sudo().attachment_ids
attachments.generate_access_token()
values = {
'message': message,
'attachments': attachments,
'group': group,
'mode': mode,
'archives': self._get_archives(group.id),
addons/website_mail_channel/views/website_mail_channel_templates.xml
+16 -8
View File
@@ -202,20 +202,28 @@
<div t-raw="message.body"/>
<div>
<p t-if="message.attachment_ids" class="mt8">
<p t-if="attachments" class="mt8">
<a href="#" class="o_mg_link_hide">
<i class="fa fa-chevron-right" role="img" aria-label="Hide attachments" title="Hide attachments"/> <t t-raw="len(message.attachment_ids)"/> attachments
<i class="fa fa-chevron-right" role="img" aria-label="Hide attachments" title="Hide attachments"/> <t t-raw="len(attachments)"/> attachments
</a>
<a href="#" class="o_mg_link_show">
<i class="fa fa-chevron-down" role="img" aria-label="Show attachments" title="Show attachments"/> <t t-raw="len(message.attachment_ids)"/> attachments
<i class="fa fa-chevron-down" role="img" aria-label="Show attachments" title="Show attachments"/> <t t-raw="len(attachments)"/> attachments
</a>
</p>
<div class="o_mg_link_content">
<div class="col-lg-2 col-md-3 text-center" t-foreach='message.attachment_ids' t-as='attachment'>
<a t-attf-href="/web/content/#{attachment.id}?download=true" target="_blank">
<div class='oe_attachment_embedded o_image' t-att-title="attachment.name" t-att-data-mimetype="attachment.mimetype" t-attf-data-src="/web/image/#{attachment.id}/100x80"/>
<div class='oe_attachment_name'><t t-raw='attachment.name' /></div>
</a>
<div class="col-lg-2 col-md-3 text-center" t-foreach='attachments' t-as='attachment'>
<t t-if="attachment.access_token">
<a t-attf-href="/web/content/#{attachment.id}?download=true&amp;access_token=#{attachment.access_token}" target="_blank">
<div class='oe_attachment_embedded o_image' t-att-title="attachment.name" t-att-data-mimetype="attachment.mimetype" t-attf-data-src="/web/image/#{attachment.id}/100x80"/>
<div class='oe_attachment_name'><t t-raw='attachment.name' /></div>
</a>
</t>
<t t-else="">
<a t-attf-href="/web/content/#{attachment.id}?download=true" target="_blank">
<div class='oe_attachment_embedded o_image' t-att-title="attachment.name" t-att-data-mimetype="attachment.mimetype" t-attf-data-src="/web/image/#{attachment.id}/100x80"/>
<div class='oe_attachment_name'><t t-raw='attachment.name' /></div>
</a>
</t>
</div>
</div>
</div>