From 2d10c5eb432412c55b452c2aea12ee473b85b92e Mon Sep 17 00:00:00 2001 From: Nicolas Lempereur Date: Fri, 3 Mar 2017 20:40:50 +0100 Subject: [PATCH] [FIX] website: use public user for sitemap making (up to s14) The current user was used to generate the sitemap. So if a user with more permissions than `public user` goes on the sitemap, he could generate it (if he is the first to see it or the last generation was more than 12 hours ago (by default)) and have pages unavailables for a user with lower permission in the sitemap (until the sitemap is generated again). The issue was solved in 8.0 with d08facdcb but was introduced back in 10.0 with fd09ddb6f because the `uid` argument was dropped from `generate` method on `ModelConverter`. From 10.0 up to saas-14 the fix introduced is to use a `use_public_user` key in `request.context` but in master we will keep the fd09ddb6f fix by adding uid to the `generate` method. opw-708456 note: to forward-port only up to saas-14 --- addons/website/controllers/main.py | 2 +- addons/website/models/ir_http.py | 2 ++ 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/addons/website/controllers/main.py b/addons/website/controllers/main.py index a1424a72a18..1e5e5a09dd7 100644 --- a/addons/website/controllers/main.py +++ b/addons/website/controllers/main.py @@ -168,7 +168,7 @@ class Website(Home): sitemaps.unlink() pages = 0 - locs = request.website.sudo(user=request.website.user_id.id).enumerate_pages() + locs = request.website.with_context(use_public_user=True).enumerate_pages() while True: values = { 'locs': islice(locs, 0, LOC_PER_SITEMAP), diff --git a/addons/website/models/ir_http.py b/addons/website/models/ir_http.py index be90d31c341..b69f9417ac2 100644 --- a/addons/website/models/ir_http.py +++ b/addons/website/models/ir_http.py @@ -363,6 +363,8 @@ class ModelConverter(ir.ir_http.ModelConverter): def generate(self, query=None, args=None): Model = request.env[self.model] + if request.context.get('use_public_user'): + Model = Model.sudo(request.website.user_id.id) domain = safe_eval(self.domain, (args or {}).copy()) if query: domain.append((Model._rec_name, 'ilike', '%' + query + '%'))