From 44c3a6ef8dfaacb0b347d9efd28651162de139ca Mon Sep 17 00:00:00 2001
From: David Beguin <dbe@odoo.com>
Date: Thu, 30 Jan 2020 13:39:31 +0000
Subject: [PATCH] [FIX] survey: allow question answer image for public users

As well as background, suggested answers images are not available for public
users as they don't have access rights on that model. This commit adds a route
called by survey template that render the suggested answers image in sudo mode.

closes odoo/odoo#44351

Signed-off-by: Thibault Delavallee (tde) <tde@openerp.com>
---
 addons/survey/controllers/main.py        | 18 ++++++++++++++++++
 addons/survey/views/survey_templates.xml |  7 ++++---
 2 files changed, 22 insertions(+), 3 deletions(-)

diff --git a/addons/survey/controllers/main.py b/addons/survey/controllers/main.py
index 7c971d65ab9..5f47305afa0 100644
--- a/addons/survey/controllers/main.py
+++ b/addons/survey/controllers/main.py
@@ -299,6 +299,24 @@ class Survey(http.Controller):
 
         return Binary._content_image_get_response(status, headers, image_base64)
 
+    @http.route('/survey/get_question_image/<string:survey_token>/<string:answer_token>/<int:question_id>/<int:suggested_answer_id>', type='http', auth="public", website=True, sitemap=False)
+    def survey_get_question_image(self, survey_token, answer_token, question_id, suggested_answer_id):
+        access_data = self._get_access_data(survey_token, answer_token, ensure_token=True)
+        if access_data['validity_code'] is not True:
+            return werkzeug.exceptions.Forbidden()
+
+        survey_sudo, answer_sudo = access_data['survey_sudo'], access_data['answer_sudo']
+
+        if not survey_sudo.question_ids.filtered(lambda q: q.id == question_id)\
+                          .suggested_answer_ids.filtered(lambda a: a.id == suggested_answer_id):
+            return werkzeug.exceptions.NotFound()
+
+        status, headers, image_base64 = request.env['ir.http'].sudo().binary_content(
+            model='survey.question.answer', id=suggested_answer_id, field='value_image',
+            default_mimetype='image/png')
+
+        return Binary._content_image_get_response(status, headers, image_base64)
+
     # ----------------------------------------------------------------
     # JSON ROUTES to begin / continue survey (ajax navigation) + Tools
     # ----------------------------------------------------------------
diff --git a/addons/survey/views/survey_templates.xml b/addons/survey/views/survey_templates.xml
index 423754adee5..4d0ce27189e 100644
--- a/addons/survey/views/survey_templates.xml
+++ b/addons/survey/views/survey_templates.xml
@@ -302,9 +302,10 @@
 
     <template id="question_suggested_value_image" name="Image from the question suggested answer">
         <div t-if="question.allow_value_image and label.value_image"
-            t-field="label.value_image"
-            class="d-flex my-3 justify-content-center"
-            t-options='{"widget": "image", "alt-field": "name", "itemprop": "image"}'/>
+             class="d-flex my-3 justify-content-center">
+            <img t-att-src="'/survey/get_question_image/%s/%s/%s/%s' % (survey.access_token, answer.access_token, question.id, label.id)"/>
+        </div>
+
     </template>
 
     <template id="question_simple_choice" name="Question: simple choice">