[FIX] purchase: access forbidden for product image on order line

When a user accesses a PO through the portal thanks to an access token
(without being connected), the product image on each order line is
rendered using the image placeholder with a size of 48x48.

This raises a 403 Forbidden at image retrieval since the access token is
not passed as a parameter. This commit corrects that behavior by sending
the resized image along with the rendering of the template instead of an
url.

Another solution could be to generalize the access token check to any
model in:
https://github.com/odoo/odoo/blob/12.0/odoo/addons/base/models/ir_http.py#L303-L311

But this seems overkill regarding this specific error.

opw-1902741

closes odoo/odoo#28479

addons/purchase/controllers/portal.py

@@ -2,10 +2,12 @@
 # Part of Odoo. See LICENSE file for full copyright and licensing details.
 
 from collections import OrderedDict
+from functools import partial
 
 from odoo import http
 from odoo.exceptions import AccessError, MissingError
 from odoo.http import request
+from odoo.tools import image_resize_image
 from odoo.tools.translate import _
 from odoo.addons.portal.controllers.portal import pager as portal_pager, CustomerPortal
 
@@ -22,6 +24,7 @@ class CustomerPortal(CustomerPortal):
     def _purchase_order_get_page_view_values(self, order, access_token, **kwargs):
         values = {
             'order': order,
+            'resize_to_48': partial(image_resize_image, size=(48, 48)),
         }
         return self._get_page_view_values(order, access_token, values, 'my_purchases_history', True, **kwargs)
 

addons/purchase/views/portal_templates.xml

@@ -95,7 +95,7 @@
               <t t-foreach="order.order_line" t-as="ol">
                 <div class="row purchases_vertical_align">
                   <div class="col-lg-1 text-center">
-                      <img t-att-src="'/web/image/purchase.order.line/%s/product_image/48x48' % ol.id" alt="Product"/>
+                      <img t-att-src="image_data_uri(resize_to_48(ol.product_id.image))" alt="Product"/>
                   </div>
                   <div id='product_name' class="col-lg-5">
                     <span t-esc="ol.product_id.name"/>