From 65ac6b8ae328179f244a3530f6f174c7a32ad1c1 Mon Sep 17 00:00:00 2001 From: Nicolas Lempereur Date: Mon, 6 Mar 2017 12:57:12 +0100 Subject: [PATCH] [FIX] website: use public user for sitemap making The current user was used to generate the sitemap. So if a user with more permissions than `public user` goes on the sitemap, he could generate it (if he is the first to see it or the last generation was more than 12 hours ago (by default)) and have pages unavailables for a user with lower permission in the sitemap (until the sitemap is generated again). The issue was solved in 8.0 with d08facdcb but was introduced back in 10.0 with fd09ddb6f because the `uid` argument was dropped from `generate` method on `ModelConverter`. Ths fix add the `uid` parameter back. opw-708456 --- addons/website/models/ir_http.py | 8 ++++---- addons/website/models/website.py | 2 +- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/addons/website/models/ir_http.py b/addons/website/models/ir_http.py index ca519654ad1..077b9599ef8 100644 --- a/addons/website/models/ir_http.py +++ b/addons/website/models/ir_http.py @@ -361,8 +361,8 @@ class ModelConverter(ir.ir_http.ModelConverter): record_id = abs(record_id) return env[self.model].browse(record_id) - def generate(self, query=None, args=None): - Model = request.env[self.model] + def generate(self, uid, query=None, args=None): + Model = request.env[self.model].sudo(uid) domain = safe_eval(self.domain, (args or {}).copy()) if query: domain.append((Model._rec_name, 'ilike', '%' + query + '%')) @@ -374,8 +374,8 @@ class ModelConverter(ir.ir_http.ModelConverter): class PageConverter(werkzeug.routing.PathConverter): """ Only point of this converter is to bundle pages enumeration logic """ - def generate(self, query=None, args={}): - View = request.env['ir.ui.view'] + def generate(self, uid, query=None, args={}): + View = request.env['ir.ui.view'].sudo(uid) domain = [('page', '=', True)] query = query and query.startswith('website.') and query[8:] or query if query: diff --git a/addons/website/models/website.py b/addons/website/models/website.py index 95a229cda71..bb26fc7ee85 100644 --- a/addons/website/models/website.py +++ b/addons/website/models/website.py @@ -550,7 +550,7 @@ class Website(models.Model): newval = [] for val in values: query = i == len(convitems)-1 and query_string - for value_dict in converter.generate(query=query, args=val): + for value_dict in converter.generate(uid=self.env.uid, query=query, args=val): newval.append(val.copy()) value_dict[name] = value_dict['loc'] del value_dict['loc']