From 3d607880e6ed0dedc5142e3778bb0bb4ef49c32e Mon Sep 17 00:00:00 2001 From: jem-odoo Date: Fri, 15 Feb 2019 10:42:09 +0000 Subject: [PATCH] [FIX] portal: posting message without token This commit e84779749b14c4f9c9309db1b25c251f3734f5e8 factorize the check of special access to post a message using a token mecanism, but it breaks the case without token. Indeed, on some models, it is allow to post a message on a document when having a certain access. This is handle with the `_mail_post_access` attribute on model inheriting mail.thread. Using this mecanism, a user that can read (or write) the document can also post a message. This is used in the eShop to review product and in blog to comment blogpost. This commit restore posting a message without token. the normal access rights will be applied by message post and raise if the user can not post message, taking `_mail_post_access` into account. The balance is now restored in the universe. Task-1902304 --- addons/portal/controllers/mail.py | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/addons/portal/controllers/mail.py b/addons/portal/controllers/mail.py index 110821d0174..411106dc188 100644 --- a/addons/portal/controllers/mail.py +++ b/addons/portal/controllers/mail.py @@ -52,12 +52,14 @@ def _message_post_helper(res_model, res_id, message, token='', nosubscribe=True, """ record = request.env[res_model].browse(res_id) - # check if user can post - pid = int(kw['pid']) if kw.get('pid') else False - if _check_special_access(res_model, res_id, token=token, _hash=kw.get('hash'), pid=pid): - record = record.sudo() - else: - raise Forbidden() + # check if user can post with special token/signed token. The "else" will try to post message with the + # current user access rights (_mail_post_access use case). + if token or (kw.get('hash') and kw.get('pid')): + pid = int(kw['pid']) if kw.get('pid') else False + if _check_special_access(res_model, res_id, token=token, _hash=kw.get('hash'), pid=pid): + record = record.sudo() + else: + raise Forbidden() # deduce author of message author_id = request.env.user.partner_id.id if request.env.user.partner_id else False