From 1e77f2fde81f898305149d2ec8c3499afe14a02c Mon Sep 17 00:00:00 2001
From: Yannick Tivisse <yti@odoo.com>
Date: Fri, 31 May 2019 10:03:49 +0000
Subject: [PATCH] [FIX] mail: Fix /mail/view/ controller when not logged in

closes odoo/odoo#33756

Signed-off-by: Yannick Tivisse (yti) <yti@odoo.com>
---
 addons/mail/controllers/main.py              |  4 +++-
 addons/test_mail/tests/test_multi_company.py | 13 +++++++++++--
 2 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/addons/mail/controllers/main.py b/addons/mail/controllers/main.py
index fc091dfe92a..e617935120a 100644
--- a/addons/mail/controllers/main.py
+++ b/addons/mail/controllers/main.py
@@ -53,6 +53,7 @@ class MailController(http.Controller):
         # to give access to the record to a recipient that has normally no access.
         uid = request.session.uid
         user = request.env['res.users'].sudo().browse(uid)
+        cids = False
 
         # no model / res_id, meaning no possible record -> redirect to login
         if not model or not res_id or model not in request.env:
@@ -125,7 +126,8 @@ class MailController(http.Controller):
         if view_id:
             url_params['view_id'] = view_id
 
-        url_params['cids'] = ','.join([str(cid) for cid in cids])
+        if cids:
+            url_params['cids'] = ','.join([str(cid) for cid in cids])
         url = '/web?#%s' % url_encode(url_params)
         return werkzeug.utils.redirect(url)
 
diff --git a/addons/test_mail/tests/test_multi_company.py b/addons/test_mail/tests/test_multi_company.py
index 9272362d745..6149e2f429b 100644
--- a/addons/test_mail/tests/test_multi_company.py
+++ b/addons/test_mail/tests/test_multi_company.py
@@ -9,8 +9,6 @@ class TestMultiCompany(HttpCase):
 
     def test_redirect_to_records(self):
 
-        self.authenticate('admin', 'admin')
-
         self.company_A = self.env['res.company'].create({
             'name': 'Company A',
             'user_ids': [(4, self.ref('base.user_admin'))],
@@ -25,6 +23,17 @@ class TestMultiCompany(HttpCase):
             'company_id': self.company_A.id,
         })
 
+        # Test Case 0
+        # Not logged, redirect to web/login
+        response = self.url_open('/mail/view?model=%s&res_id=%s' % (
+            self.multi_company_record._name,
+            self.multi_company_record.id), timeout=15)
+
+        path = url_parse(response.url).path
+        self.assertEqual(path, '/web/login')
+
+        self.authenticate('admin', 'admin')
+
         # Test Case 1
         # Logged into company 1, try accessing record in company A
         # _redirect_to_record should add company A in allowed_company_ids