From 223b51c462ec96f45d618b867a6f3d35ae5b779e Mon Sep 17 00:00:00 2001
From: Jinal Patel <jip@odoo.com>
Date: Fri, 20 Aug 2021 07:14:09 +0000
Subject: [PATCH] [FIX] mail: fix ACLs issue with mail composer in new mode

As create_uid has no value on mail.compose.message model when being in onchange
or new mode, 'Mail Compose Message Rule' record rule may crash. In this
commit we fix that issue by adding a value for create_uid. An unit test is
added to ensure it effectively fixes the use case.

Steps to reproduce this warning:
 1. Create automated action for the 'mail.compose.message' model
 2. Try to open 'Email compose Wizard'

Warning:

"Due to security restrictions, you are not allowed to modify 'Email composition
wizard' (mail.compose.message) records.

Records: mail.compose.message,NewId_0x7f8e99762310 (id=NewId_0x7f8e99762310)
User: USERNAME (id=2)

This restriction is due to the following rules:

Contact your administrator to request access if necessary."

Task-2641572
opw-2628005
PR odoo#76159
Closes#75369

X-original-commit: 26d64c0b84b76bb9164a8895bcc21b66754478ae
Part-of: odoo/odoo#77005
Co-authored-by: Thibault Delavallee <tde@odoo.com>
---
 addons/base_automation/tests/__init__.py      |  2 +
 .../tests/test_mail_composer.py               | 39 +++++++++++++++++++
 addons/mail/tests/test_mail_full_composer.py  |  2 +-
 addons/mail/wizard/mail_compose_message.py    |  4 ++
 4 files changed, 46 insertions(+), 1 deletion(-)
 create mode 100644 addons/base_automation/tests/test_mail_composer.py

diff --git a/addons/base_automation/tests/__init__.py b/addons/base_automation/tests/__init__.py
index 92a8a4959d9..a6533bd6153 100644
--- a/addons/base_automation/tests/__init__.py
+++ b/addons/base_automation/tests/__init__.py
@@ -1,3 +1,5 @@
 # -*- coding: utf-8 -*-
 # Part of Odoo. See LICENSE file for full copyright and licensing details.
+
 from . import test_automation
+from . import test_mail_composer
diff --git a/addons/base_automation/tests/test_mail_composer.py b/addons/base_automation/tests/test_mail_composer.py
new file mode 100644
index 00000000000..2609466facd
--- /dev/null
+++ b/addons/base_automation/tests/test_mail_composer.py
@@ -0,0 +1,39 @@
+# -*- coding: utf-8 -*-
+# Part of Odoo. See LICENSE file for full copyright and licensing details.
+
+from odoo.tests.common import tagged, HttpCase
+
+
+@tagged('-at_install', 'post_install', 'mail_composer')
+class TestMailFullComposer(HttpCase):
+
+    def test_full_composer_tour(self):
+        self.env['mail.template'].create({
+            'name': 'Test template',  # name hardcoded for test
+            'partner_to': '${object.id}',
+            'lang': '${object.lang}',
+            'auto_delete': True,
+            'model_id': self.ref('base.model_res_partner'),
+        })
+        test_user = self.env['res.users'].create({
+            'email': 'testuser@testuser.com',
+            'groups_id': [
+                (6, 0, [self.ref('base.group_user'), self.ref('base.group_partner_manager')]),
+            ],
+            'name': 'Test User',
+            'login': 'testuser',
+            'password': 'testuser',
+        })
+
+        automated_action = self.env['base.automation'].create({
+            'name': 'Test',
+            'active': True,
+            'trigger': 'on_change',
+            'on_change_field_ids': (4, self.ref('mail.field_mail_compose_message__template_id'),),
+            'state': 'code',
+            'model_id': self.env.ref('mail.model_mail_compose_message').id,
+        })
+
+        self.start_tour("/web#id=%d&model=res.partner" % test_user.partner_id, 'mail/static/tests/tours/mail_full_composer_test_tour.js', login='testuser')
+
+        automated_action.unlink()
diff --git a/addons/mail/tests/test_mail_full_composer.py b/addons/mail/tests/test_mail_full_composer.py
index 1456dba505a..0921a698f8f 100644
--- a/addons/mail/tests/test_mail_full_composer.py
+++ b/addons/mail/tests/test_mail_full_composer.py
@@ -5,7 +5,7 @@ from odoo.tests.common import tagged, HttpCase
 from odoo import Command
 
 
-@tagged('-at_install', 'post_install')
+@tagged('-at_install', 'post_install', 'mail_composer')
 class TestMailFullComposer(HttpCase):
 
     def test_full_composer_tour(self):
diff --git a/addons/mail/wizard/mail_compose_message.py b/addons/mail/wizard/mail_compose_message.py
index f9f032e04f7..9415fa2c543 100644
--- a/addons/mail/wizard/mail_compose_message.py
+++ b/addons/mail/wizard/mail_compose_message.py
@@ -75,6 +75,10 @@ class MailComposer(models.TransientModel):
         if result.get('composition_mode') == 'comment' and (set(fields) & set(['model', 'res_id', 'partner_ids', 'record_name', 'subject'])):
             result.update(self.get_record_data(result))
 
+        # when being in new mode, create_uid is not granted -> ACLs issue may arise
+        if 'create_uid' in fields and 'create_uid' not in result:
+            result['create_uid'] = self.env.uid
+
         filtered_result = dict((fname, result[fname]) for fname in result if fname in fields)
         return filtered_result