From 5e4e6e919fa613f3fbd9cfc88d62a5b115c9a908 Mon Sep 17 00:00:00 2001 From: Ethan Vincent Date: Tue, 27 Feb 2024 15:29:18 +0100 Subject: [PATCH] [FIX] pos_self_order: decode home images as sudo **Current behavior:** Trying to access the mobile order menu for a pos restaurant with some non-default landing page images as a non-admin user will result in an access error. **Expected behavior:** The images should load on this page for anyone who has a valid access token for the page route. **Steps to reproduce:** 1. Make a restaurant in the POS application 2. Enable mobile ordering and set a database user with `user` level access to the POS app to be the default user for this newly created restaurant 3. Upload a splash image for the restaurant 3. On the POS dashboard, select the three vertical dot button on the restaurant -> `Mobile Menu` to get the access error **Cause of the issue:** The default user on the restaurant POS will not necessarily have access rights to the `ir.attachment` model/records. **Fix:** Get the images as sudo()- IMO there isn't a reason these should be inaccessible to anybody considering they are intended to be seen on the landing page by people trying to order. opw-3748314 closes odoo/odoo#155589 Signed-off-by: Joseph Caburnay (jcb) --- addons/pos_self_order/models/pos_config.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/addons/pos_self_order/models/pos_config.py b/addons/pos_self_order/models/pos_config.py index d7dff16cec8..15f07d0cf3b 100644 --- a/addons/pos_self_order/models/pos_config.py +++ b/addons/pos_self_order/models/pos_config.py @@ -395,7 +395,7 @@ class PosConfig(models.Model): for image in images: encoded_images.append({ 'id': image.id, - 'data': image.datas.decode('utf-8'), + 'data': image.sudo().datas.decode('utf-8'), }) return encoded_images