[FIX] website_profile: bypass IR Rules on karma ranking
Install website_slides, create a bunch of users all published on the website. Using raw sql queries, give some karma to those users. Go to the `/profile/users` web page. When connected the ranking is correctly shown, when not connected all users are ranked 0. The problem is that the public user (id: 4) can only access is own user which prevent him to access the karma of the other user required to rank them. As the injected IR Rules are not adding any value and that a domain is applied already, it is safe to skip the ir rules. opw-2029105 closes odoo/odoo#34656 Signed-off-by: Nicolas Lempereur (nle) <nle@odoo.com>
This commit is contained in:
@@ -250,7 +250,6 @@ class WebsiteProfile(http.Controller):
|
||||
|
||||
Users = request.env['res.users']
|
||||
where_query = Users._where_calc(domain)
|
||||
Users._apply_ir_rules(where_query, 'read')
|
||||
from_clause, where_clause, where_clause_params = where_query.get_sql()
|
||||
|
||||
# we search on every user in the DB to get the real positioning (not the one inside the subset)
|
||||
|
||||
Reference in New Issue
Block a user