From 548126f1f6e407b7f69b6d055f416fdcd246f4f5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=A9rome=20Maes?= <jem@openerp.com>
Date: Mon, 16 Jan 2017 09:39:07 +0100
Subject: [PATCH] [IMP] website_mail: use access right rather then hardcoded
 domain

---
 addons/website_mail/__manifest__.py                 |  1 +
 addons/website_mail/controllers/main.py             |  3 ---
 .../website_mail/security/website_mail_security.xml | 13 +++++++++++++
 3 files changed, 14 insertions(+), 3 deletions(-)
 create mode 100644 addons/website_mail/security/website_mail_security.xml

diff --git a/addons/website_mail/__manifest__.py b/addons/website_mail/__manifest__.py
index 4097c774b6e..d0c73141faa 100644
--- a/addons/website_mail/__manifest__.py
+++ b/addons/website_mail/__manifest__.py
@@ -11,6 +11,7 @@
     'data': [
         'views/website_mail_templates.xml',
         'data/mail_channel_data.xml',
+        'security/website_mail_security.xml',
     ],
     'qweb': [
         'static/src/xml/website_mail.xml'
diff --git a/addons/website_mail/controllers/main.py b/addons/website_mail/controllers/main.py
index c0e8354610d..c10525fd5e0 100644
--- a/addons/website_mail/controllers/main.py
+++ b/addons/website_mail/controllers/main.py
@@ -144,9 +144,6 @@ class WebsiteMail(http.Controller):
         field_domain = request.env[res_model]._fields['website_message_ids'].domain
         domain += field_domain(request.env[res_model]) if callable(field_domain) else field_domain
         domain += [('res_id', '=', res_id)]
-        # None published can see only the published messages
-        if not request.env.user.has_group('website.group_website_publisher'):
-            domain += [('website_published', '=', True)]
         # Check access
         Message = request.env['mail.message']
         if kw.get('token'):
diff --git a/addons/website_mail/security/website_mail_security.xml b/addons/website_mail/security/website_mail_security.xml
new file mode 100644
index 00000000000..0144b11e5ed
--- /dev/null
+++ b/addons/website_mail/security/website_mail_security.xml
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="utf-8"?>
+<odoo>
+    <data noupdate="1">
+
+        <record id="mail_message_rule_public" model="ir.rule">
+            <field name="name">mail.message: portal/public: read published messages</field>
+            <field name="model_id" ref="model_mail_message"/>
+            <field name="domain_force">[('website_published', '=', True)]</field>
+            <field name="groups" eval="[(4, ref('base.group_portal')), (4, ref('base.group_public'))]"/>
+        </record>
+
+    </data>
+</odoo>