From 794ebb0aafbac72051f4d150fd42f7bbc640a325 Mon Sep 17 00:00:00 2001 From: jem-odoo Date: Thu, 7 Feb 2019 08:49:53 +0000 Subject: [PATCH] [FIX] portal: cast type to consteq signed token To post a comment with a signed token, we compare tokens with the pid. The token is signed with the pid, which is an integer. When checking access, we compare the token with a pid as char. Obviously, the comparison failed, and posting the message is refused, as the 2 'pid' does not share the same type. This commit cast the recieved 'pid' into an integer before checking special access. closes odoo/odoo#30906 --- addons/portal/controllers/mail.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/addons/portal/controllers/mail.py b/addons/portal/controllers/mail.py index cfa2a91aa69..110821d0174 100644 --- a/addons/portal/controllers/mail.py +++ b/addons/portal/controllers/mail.py @@ -53,7 +53,8 @@ def _message_post_helper(res_model, res_id, message, token='', nosubscribe=True, record = request.env[res_model].browse(res_id) # check if user can post - if _check_special_access(res_model, res_id, token=token, _hash=kw.get('hash'), pid=kw.get('pid')): + pid = int(kw['pid']) if kw.get('pid') else False + if _check_special_access(res_model, res_id, token=token, _hash=kw.get('hash'), pid=pid): record = record.sudo() else: raise Forbidden()