diff --git a/addons/digest/controllers/portal.py b/addons/digest/controllers/portal.py index 451956a7bfa..31cf3197e99 100644 --- a/addons/digest/controllers/portal.py +++ b/addons/digest/controllers/portal.py @@ -1,21 +1,34 @@ # -*- coding: utf-8 -*- # Part of Odoo. See LICENSE file for full copyright and licensing details. -from werkzeug.exceptions import Forbidden +from werkzeug.exceptions import Forbidden, NotFound from werkzeug.urls import url_encode from odoo import _ from odoo.http import Controller, request, route +from odoo.tools import consteq class DigestController(Controller): - @route('/digest//unsubscribe', type='http', website=True, auth='user') - def digest_unsubscribe(self, digest_id): - digest = request.env['digest.digest'].browse(digest_id).exists() - digest.action_unsubcribe() + @route('/digest//unsubscribe', type='http', website=True, auth='public') + def digest_unsubscribe(self, digest_id, token=None, user_id=None): + digest_sudo = request.env['digest.digest'].sudo().browse(digest_id).exists() + + # new route parameters + if digest_sudo and token and user_id: + correct_token = digest_sudo._get_unsubscribe_token(int(user_id)) + if not consteq(correct_token, token): + raise NotFound() + digest_sudo._action_unsubscribe_users(request.env['res.users'].sudo().browse(int(user_id))) + # old route was given without any token or user_id but only for auth users + elif digest_sudo and not token and not user_id and not request.env.user.share: + digest_sudo.action_unsubcribe() + else: + raise NotFound() + return request.render('digest.portal_digest_unsubscribed', { - 'digest': digest, + 'digest': digest_sudo, }) @route('/digest//set_periodicity', type='http', website=True, auth='user') diff --git a/addons/digest/data/digest_data.xml b/addons/digest/data/digest_data.xml index 4c9da812c83..1d7826141cb 100644 --- a/addons/digest/data/digest_data.xml +++ b/addons/digest/data/digest_data.xml @@ -391,21 +391,36 @@ -
+ + +
-
+
- Sent by Odoo – - Unsubscribe + Sent by Odoo + + – + + Unsubscribe + + + + – + + Unsubscribe + +
-