From 40667755b1fc78c93c6cf34e308cf7b12d91c7a0 Mon Sep 17 00:00:00 2001 From: Martin Trigaux Date: Fri, 7 Feb 2020 10:50:45 +0000 Subject: [PATCH] [FIX] website: restrict access to route This route was public by mistake, probably introduced to test during ddf32f4 but no reason to make it public, public user has not the write access on models anyway. Courtesy of Swapnesh Shah closes odoo/odoo#44915 X-original-commit: 66ac96b25aa4cf2b074f6c06b57ed8be72d6d647 Signed-off-by: Martin Trigaux (mat) --- addons/website/controllers/main.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/addons/website/controllers/main.py b/addons/website/controllers/main.py index 394a76e25d0..8019abba5c4 100644 --- a/addons/website/controllers/main.py +++ b/addons/website/controllers/main.py @@ -307,7 +307,7 @@ class Website(Home): view.with_context(website_id=None).reset_arch(mode) return request.redirect(redirect) - @http.route(['/website/publish'], type='json', auth="public", website=True) + @http.route(['/website/publish'], type='json', auth="user", website=True) def publish(self, id, object): Model = request.env[object] record = Model.browse(int(id))