[FIX] mail: access error for the id of another company

When creating a mail for a user in an other company then the
record, the "send" button fails with a traceback because on
specific template try to access the company.id of the user
which is not accessible due to the access controle.

This PR fixes the problem by sudoing the access to company id.
The mail now sends without problem.

Step to reproduce:

1. Use two companies (comp1 and comp2)
2. Use 3 users (user1, user2, user3)
3. Be sure every user has a confirmed account
4. Change the users to set both company as allowed.
5. Set the current company of the users as follow:
   user1: comp1
   user2: comp2
   user3: comp2
6. Install the project module
7. In `settings > security > record rules`, archive the rules named:
   - `Project: multiple-company`
   - `Project/Task: multiple-company`
   - `user rule`
8. Using user1, create a new project and a new task.
9. Using user2, go to `Project module > Search`, remove `My tasks` filter,
   select the task created by user1, in the chatter add user3 as follower.
10. Send the mail => access error.

The `AccessError` is due to user2 trying to access comp1, in particular
`company.name`.

By adding a `sudo`, we also make sure that the template rendering won't
fail bacause of a similar `AccessError`.

opw-1907844

closes odoo/odoo#28710
This commit is contained in:
Julien (juc) Castiaux
2018-11-26 09:49:50 +00:00
committed by Nicolas Martinelli
parent c9e32872c0
commit 5c38c87ddd
+1 -1
View File
@@ -75,7 +75,7 @@ class Partner(models.Model):
company = user.company_id;
if record and hasattr(record, 'company_id'):
company = record.company_id;
company = record.company_id.sudo()
company_name = company.name;
return {