From 7bde7b90161466fc8e6f451bc1fff3ec7b4153d3 Mon Sep 17 00:00:00 2001 From: Denis Ledoux Date: Tue, 19 Apr 2016 15:02:08 +0200 Subject: [PATCH] [FIX] mail: `message_post` requires record write access By default, users are supposed to be able to write messages in threads only if they have the write access on the record. This behavior is the behavior defined in Odoo 8.0. This behavior can be changed by defining `_mail_post_access` on the model, to allow the creation of new messages if the user has only the read access, for instance. This is the case on `project.issue`, for instance. Since 9.0, @ revision 88b8cd058713bfad2942f7e7434c34b6c1a6e7da, this behavior was broken: Any users having the read access on the record was allowed to write messages in the thread, while this should not be the case, except if `_mail_post_access = 'read'` has been defined on the model. This is because the SQL query which is performed in order to know the thread messages the user has been notified of was expected to return only the ids of the notified message, while it actually always returned all the message ids of the thread, because of the LEFT JOINS, e.g. ``` LEFT JOIN "mail_message_res_partner_rel" partner_rel ON partner_rel.mail_message_id = m.id AND partner_rel.res_partner_id = (%%s) ``` Instead of just checking the ids of the messages returned by this query, it must check that one of the two columns `partner_rel.res_partner_id` or `channel_partner.partner_id` is filled, meaning the partner has been notified of the message or is a member of the channel the message has been posted to. opw-668589 --- addons/mail/models/mail_message.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/addons/mail/models/mail_message.py b/addons/mail/models/mail_message.py index 05224add86a..fe7d6d88448 100644 --- a/addons/mail/models/mail_message.py +++ b/addons/mail/models/mail_message.py @@ -762,7 +762,7 @@ class Message(models.Model): # TDE: probably clean me parent_ids = [message.get('parent_id') for mid, message in message_values.iteritems() if message.get('parent_id')] - self._cr.execute("""SELECT DISTINCT m.id FROM "%s" m + self._cr.execute("""SELECT DISTINCT m.id, partner_rel.res_partner_id, channel_partner.partner_id FROM "%s" m LEFT JOIN "mail_message_res_partner_rel" partner_rel ON partner_rel.mail_message_id = m.id AND partner_rel.res_partner_id = (%%s) LEFT JOIN "mail_message_mail_channel_rel" channel_rel @@ -772,7 +772,7 @@ class Message(models.Model): LEFT JOIN "mail_channel_partner" channel_partner ON channel_partner.channel_id = channel.id AND channel_partner.partner_id = (%%s) WHERE m.id = ANY (%%s)""" % self._table, (self.env.user.partner_id.id, self.env.user.partner_id.id, parent_ids,)) - not_parent_ids = [mid[0] for mid in self._cr.fetchall()] + not_parent_ids = [mid[0] for mid in self._cr.fetchall() if any([mid[1], mid[2]])] notified_ids += [mid for mid, message in message_values.iteritems() if message.get('parent_id') in not_parent_ids]