From 1d21bb4bcb99da6f169547c8ad1d23f6b555cd4f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Thibault=20Delavall=C3=A9e?= <tde@odoo.com>
Date: Fri, 12 Mar 2021 13:45:15 +0000
Subject: [PATCH] [FIX] website_mail_channel: let portal readers access
 attachments

As reading attachments is not possible for portal users displaying a
message in mailing list frontend crashes if there is any attachment linked
to the message. Moreover downloading it would be impossible as access is
not granted.

In this commit we display attachments as sudo. Indeed if current portal user
has access to the message he should be able to access its attachments as they
are part of it. Moreover missing access tokens are generated on the fly to
enable download of attachments.

LINKS

Task ID-2070632 (main task)
Task ID-2419762 (followup task)
COM PR odoo/odoo#62859
ENT PR odoo/enterprise#15172
UPG PR odoo/upgrade#2005
---
 .../website_mail_channel/controllers/main.py  | 11 +++++++++
 .../views/website_mail_channel_templates.xml  | 24 ++++++++++++-------
 2 files changed, 27 insertions(+), 8 deletions(-)

diff --git a/addons/website_mail_channel/controllers/main.py b/addons/website_mail_channel/controllers/main.py
index 37dd899b3fc..143b6f08e37 100644
--- a/addons/website_mail_channel/controllers/main.py
+++ b/addons/website_mail_channel/controllers/main.py
@@ -175,8 +175,19 @@ class MailGroup(http.Controller):
             base_domain = [('model', '=', 'mail.channel'), ('res_id', '=', group.id)]
         next_message = Message.search(base_domain + [('date', '<', message.date)], order="date DESC", limit=1) or None
         prev_message = Message.search(base_domain + [('date', '>', message.date)], order="date", limit=1) or None
+
+        # handle access to attachments for public / portal
+        if request.env.user.has_group('base.group_user'):
+            attachments = message.attachment_ids
+        else:
+            # portal / external people cannot access attachments -> grant access
+            # as message is ok, generate access tokens
+            attachments = message.sudo().attachment_ids
+            attachments.generate_access_token()
+
         values = {
             'message': message,
+            'attachments': attachments,
             'group': group,
             'mode': mode,
             'archives': self._get_archives(group.id),
diff --git a/addons/website_mail_channel/views/website_mail_channel_templates.xml b/addons/website_mail_channel/views/website_mail_channel_templates.xml
index 4e247afd621..fe88c9e9d7f 100644
--- a/addons/website_mail_channel/views/website_mail_channel_templates.xml
+++ b/addons/website_mail_channel/views/website_mail_channel_templates.xml
@@ -202,20 +202,28 @@
                             <div t-raw="message.body"/>
 
                             <div>
-                                <p t-if="message.attachment_ids" class="mt8">
+                                <p t-if="attachments" class="mt8">
                                     <a href="#" class="o_mg_link_hide">
-                                        <i class="fa fa-chevron-right" role="img" aria-label="Hide attachments" title="Hide attachments"/> <t t-raw="len(message.attachment_ids)"/> attachments
+                                        <i class="fa fa-chevron-right" role="img" aria-label="Hide attachments" title="Hide attachments"/> <t t-raw="len(attachments)"/> attachments
                                     </a>
                                     <a href="#" class="o_mg_link_show">
-                                        <i class="fa fa-chevron-down" role="img" aria-label="Show attachments" title="Show attachments"/> <t t-raw="len(message.attachment_ids)"/> attachments
+                                        <i class="fa fa-chevron-down" role="img" aria-label="Show attachments" title="Show attachments"/> <t t-raw="len(attachments)"/> attachments
                                     </a>
                                 </p>
                                 <div class="o_mg_link_content">
-                                    <div class="col-lg-2 col-md-3 text-center" t-foreach='message.attachment_ids' t-as='attachment'>
-                                        <a t-attf-href="/web/content/#{attachment.id}?download=true" target="_blank">
-                                            <div class='oe_attachment_embedded o_image' t-att-title="attachment.name" t-att-data-mimetype="attachment.mimetype" t-attf-data-src="/web/image/#{attachment.id}/100x80"/>
-                                            <div class='oe_attachment_name'><t t-raw='attachment.name' /></div>
-                                        </a>
+                                    <div class="col-lg-2 col-md-3 text-center" t-foreach='attachments' t-as='attachment'>
+                                        <t t-if="attachment.access_token">
+                                            <a t-attf-href="/web/content/#{attachment.id}?download=true&amp;access_token=#{attachment.access_token}" target="_blank">
+                                                <div class='oe_attachment_embedded o_image' t-att-title="attachment.name" t-att-data-mimetype="attachment.mimetype" t-attf-data-src="/web/image/#{attachment.id}/100x80"/>
+                                                <div class='oe_attachment_name'><t t-raw='attachment.name' /></div>
+                                            </a>
+                                        </t>
+                                        <t t-else="">
+                                            <a t-attf-href="/web/content/#{attachment.id}?download=true" target="_blank">
+                                                <div class='oe_attachment_embedded o_image' t-att-title="attachment.name" t-att-data-mimetype="attachment.mimetype" t-attf-data-src="/web/image/#{attachment.id}/100x80"/>
+                                                <div class='oe_attachment_name'><t t-raw='attachment.name' /></div>
+                                            </a>
+                                        </t>
                                     </div>
                                 </div>
                             </div>