From 525e3626bee3ebf7ff182a70cf88c17acbb2d569 Mon Sep 17 00:00:00 2001 From: Nicolas Lempereur Date: Fri, 13 Dec 2019 16:51:43 +0000 Subject: [PATCH] [FIX] project: access to portal task give access to attachment If a visitor has access to a task through access_token, he should have access to the task attachments. He already see the list of attachment and their name, but since the task access_token is not propagated to the attachment he doesn't have the rights to see them. In this PR, we generate the attachments access_token and provide them to the user that is viewing a task with an access_token. opw-2125252 closes #41881 closes odoo/odoo#42121 X-original-commit: e7984c4968cde2019edca6c767d2acce2f7fe3f4 Signed-off-by: Nicolas Lempereur (nle) --- addons/project/controllers/portal.py | 3 +++ addons/project/views/project_portal_templates.xml | 4 ++-- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/addons/project/controllers/portal.py b/addons/project/controllers/portal.py index 200e151cc80..a8d2cc90514 100644 --- a/addons/project/controllers/portal.py +++ b/addons/project/controllers/portal.py @@ -230,5 +230,8 @@ class CustomerPortal(CustomerPortal): except (AccessError, MissingError): return request.redirect('/my') + # ensure attachment are accessible with access token inside template + for attachment in task_sudo.attachment_ids: + attachment.generate_access_token() values = self._task_get_page_view_values(task_sudo, access_token, **kw) return request.render("project.portal_my_task", values) diff --git a/addons/project/views/project_portal_templates.xml b/addons/project/views/project_portal_templates.xml index 305a42d61ff..d5b3446db05 100644 --- a/addons/project/views/project_portal_templates.xml +++ b/addons/project/views/project_portal_templates.xml @@ -245,8 +245,8 @@