From 5ab794cf30009acc522f8495b9dbe2ed793c39f5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?S=C3=A9bastien=20Theys?= <seb@odoo.com>
Date: Tue, 24 Nov 2020 10:56:26 +0000
Subject: [PATCH] [FIX] mail: avoid adding non-members on mention in channels
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

task-2392010

closes odoo/odoo#62242

X-original-commit: 0a3fe0a513abbde8f74d59de522a216035cdcd98
Signed-off-by: Alexandre Kühn (aku) <aku@odoo.com>
Signed-off-by: Sébastien Theys (seb) <seb@odoo.com>
---
 .../src/components/composer/composer_tests.js | 55 +++++++++++++++++++
 .../static/src/models/composer/composer.js    |  4 ++
 2 files changed, 59 insertions(+)

diff --git a/addons/mail/static/src/components/composer/composer_tests.js b/addons/mail/static/src/components/composer/composer_tests.js
index 0b21c908dda..81a1e9507df 100644
--- a/addons/mail/static/src/components/composer/composer_tests.js
+++ b/addons/mail/static/src/components/composer/composer_tests.js
@@ -2099,6 +2099,61 @@ QUnit.test('send message only once when enter is pressed twice quickly', async f
     );
 });
 
+QUnit.test("mentioned partners should not be notified if they are not member of current channel", async function (assert) {
+    assert.expect(4);
+
+    this.data['res.partner'].records.push({
+        email: "testpartner@example.com",
+        name: "TestPartner",
+    });
+    this.data['mail.channel'].records.push({
+        id: 10,
+        members: [this.data.currentPartnerId],
+    });
+    await this.start({
+        async mockRPC(route, args) {
+            if (args.model === 'mail.channel' && args.method === 'message_post') {
+                assert.step('message_post');
+                assert.strictEqual(
+                    args.kwargs.partner_ids.length,
+                    0,
+                    "message_post should not contain mentioned partners that are not members of channel"
+                );
+            }
+            return this._super(...arguments);
+        },
+    });
+    const thread = this.env.models['mail.thread'].findFromIdentifyingData({
+        id: 10,
+        model: 'mail.channel',
+    });
+    await this.createComposerComponent(thread.composer);
+    await afterNextRender(() => {
+        document.querySelector(`.o_ComposerTextInput_textarea`).focus();
+        document.execCommand('insertText', false, "@");
+        document.querySelector(`.o_ComposerTextInput_textarea`)
+            .dispatchEvent(new window.KeyboardEvent('keydown'));
+        document.querySelector(`.o_ComposerTextInput_textarea`)
+            .dispatchEvent(new window.KeyboardEvent('keyup'));
+    });
+    await afterNextRender(() => {
+        document.querySelector(`.o_ComposerTextInput_textarea`).focus();
+        document.execCommand('insertText', false, "Test");
+        document.querySelector(`.o_ComposerTextInput_textarea`)
+            .dispatchEvent(new window.KeyboardEvent('keydown'));
+        document.querySelector(`.o_ComposerTextInput_textarea`)
+            .dispatchEvent(new window.KeyboardEvent('keyup'));
+    });
+    await afterNextRender(() => document.querySelector('.o_ComposerSuggestion').click());
+    assert.strictEqual(
+        document.querySelector(`.o_ComposerTextInput_textarea`).value.replace(/\s/, " "),
+        "@TestPartner ",
+        "text content of composer should have mentioned partner + additional whitespace afterwards"
+    );
+    await afterNextRender(() => document.querySelector('.o_Composer_buttonSend').click());
+    assert.verifySteps(['message_post'], "the message should be posted");
+});
+
 });
 });
 });
diff --git a/addons/mail/static/src/models/composer/composer.js b/addons/mail/static/src/models/composer/composer.js
index 8bedfa4e3d7..2e087a1bb72 100644
--- a/addons/mail/static/src/models/composer/composer.js
+++ b/addons/mail/static/src/models/composer/composer.js
@@ -188,6 +188,10 @@ function factory(dependencies) {
          * @returns {mail.partner[]}
          */
         _computeRecipients() {
+            if (this.thread && this.thread.model === 'mail.channel') {
+                // prevent from notifying/adding to followers non-members
+                return [['unlink-all']];
+            }
             const recipients = [...this.mentionedPartners];
             if (this.thread && !this.isLog) {
                 for (const recipient of this.thread.suggestedRecipientInfoList) {