From 3922182c97c5f2a889b31c1ebe90630d6838349f Mon Sep 17 00:00:00 2001
From: Nicolas Lempereur <nle@odoo.com>
Date: Mon, 20 Jul 2020 17:36:16 +0000
Subject: [PATCH] [FIX] portal: hide public user avatar in chatter

On a chatter portal, when the user is using access token to display
record and is not connected, the message will be posted as the record
partner_id.

But then the preview of avatar in the composer is wrong: you see a
broken image (because you don't have access to "public user" partner
avatar) and when you post it anyway you see the avatar of the record
partner and not public user.

In this commit, if we are seeing the record with token and are logged
out as public user, we will not show the avatar in composer.

(note: before 13.0, the "public user" partner avatar was working)

opw-2276498
closes #54720

closes odoo/odoo#54782

X-original-commit: 97473f6a25336e8994730e7722cffb6fd0dbc6d7
Signed-off-by: Nicolas Lempereur (nle) <nle@odoo.com>
---
 addons/portal/static/src/xml/portal_chatter.xml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/addons/portal/static/src/xml/portal_chatter.xml b/addons/portal/static/src/xml/portal_chatter.xml
index 8726e233591..ae3a2374913 100644
--- a/addons/portal/static/src/xml/portal_chatter.xml
+++ b/addons/portal/static/src/xml/portal_chatter.xml
@@ -29,7 +29,8 @@
             </t>
             <t t-if="widget.options['display_composer']">
                 <div class="media">
-                    <img alt="Avatar" class="o_portal_chatter_avatar" t-attf-src="/web/image/res.partner/#{widget.options['partner_id']}/image_128/50x50"/>
+                    <img alt="Avatar" class="o_portal_chatter_avatar" t-attf-src="/web/image/res.partner/#{widget.options['partner_id']}/image_128/50x50"
+                         t-if="!widget.options['is_user_public'] or !widget.options['token']"/>
                     <div class="media-body">
                         <form class="o_portal_chatter_composer_form" t-attf-action="/mail/chatter_post" method="POST">
                             <input type="hidden" name="csrf_token" t-att-value="widget.options['csrf_token']"/>