[FIX] website_slides: fix access error when user lists its own courses
To reproduce (on runbot):
- as admin, open "Furniture Technical Specifications" course
- click on "Add attendees" and select "Joel Willis" and "Send" it
- as "Joel Willis" ('portal' user) go to eLearning (/slides)
- click on "All Courses" (/slides/all?my=1)
- user get a 403 Forbidden error.
As `slide.channel.partner` is restricted to only "eLearning / Officer"
group, do the subquery as sudo() so that user can filter on it's own
courses
closes odoo/odoo#127913
X-original-commit: 085b42ea512859bda979dd566295cd8f9394c913
Signed-off-by: Thibault Delavallee (tde) <tde@openerp.com>
Signed-off-by: Xavier Alt (xal) <xal@odoo.com>
This commit is contained in:
@@ -484,7 +484,7 @@ class Channel(models.Model):
|
||||
if isinstance(value, int) and operator == 'in':
|
||||
value = [value]
|
||||
return [(
|
||||
'channel_partner_ids', '=', self.env['slide.channel.partner']._search(
|
||||
'channel_partner_ids', '=', self.env['slide.channel.partner'].sudo()._search(
|
||||
[('partner_id', operator, value),
|
||||
('active', '=', True),
|
||||
('member_status', '!=', 'invited')],
|
||||
|
||||
Reference in New Issue
Block a user