From 26bbabb1cb973009fc04cd6731d1e20d928e0d80 Mon Sep 17 00:00:00 2001 From: Xavier ALT Date: Thu, 6 Jul 2023 14:35:27 +0000 Subject: [PATCH] [FIX] website_slides: fix access error when user lists its own courses To reproduce (on runbot): - as admin, open "Furniture Technical Specifications" course - click on "Add attendees" and select "Joel Willis" and "Send" it - as "Joel Willis" ('portal' user) go to eLearning (/slides) - click on "All Courses" (/slides/all?my=1) - user get a 403 Forbidden error. As `slide.channel.partner` is restricted to only "eLearning / Officer" group, do the subquery as sudo() so that user can filter on it's own courses closes odoo/odoo#127913 X-original-commit: 085b42ea512859bda979dd566295cd8f9394c913 Signed-off-by: Thibault Delavallee (tde) Signed-off-by: Xavier Alt (xal) --- addons/website_slides/models/slide_channel.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/addons/website_slides/models/slide_channel.py b/addons/website_slides/models/slide_channel.py index 9a58e015a7c..01d5011e5b1 100644 --- a/addons/website_slides/models/slide_channel.py +++ b/addons/website_slides/models/slide_channel.py @@ -484,7 +484,7 @@ class Channel(models.Model): if isinstance(value, int) and operator == 'in': value = [value] return [( - 'channel_partner_ids', '=', self.env['slide.channel.partner']._search( + 'channel_partner_ids', '=', self.env['slide.channel.partner'].sudo()._search( [('partner_id', operator, value), ('active', '=', True), ('member_status', '!=', 'invited')],