[IMP] website_mail: use access right rather then hardcoded domain

addons/website_mail/__manifest__.py

@@ -11,6 +11,7 @@
     'data': [
         'views/website_mail_templates.xml',
         'data/mail_channel_data.xml',
+        'security/website_mail_security.xml',
     ],
     'qweb': [
         'static/src/xml/website_mail.xml'

addons/website_mail/controllers/main.py

@@ -144,9 +144,6 @@ class WebsiteMail(http.Controller):
         field_domain = request.env[res_model]._fields['website_message_ids'].domain
         domain += field_domain(request.env[res_model]) if callable(field_domain) else field_domain
         domain += [('res_id', '=', res_id)]
-        # None published can see only the published messages
-        if not request.env.user.has_group('website.group_website_publisher'):
-            domain += [('website_published', '=', True)]
         # Check access
         Message = request.env['mail.message']
         if kw.get('token'):

addons/website_mail/security/website_mail_security.xml

@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="utf-8"?>
+<odoo>
+    <data noupdate="1">
+
+        <record id="mail_message_rule_public" model="ir.rule">
+            <field name="name">mail.message: portal/public: read published messages</field>
+            <field name="model_id" ref="model_mail_message"/>
+            <field name="domain_force">[('website_published', '=', True)]</field>
+            <field name="groups" eval="[(4, ref('base.group_portal')), (4, ref('base.group_public'))]"/>
+        </record>
+
+    </data>
+</odoo>