From 8108a60dc38432243bef4f934784b119c77cf91d Mon Sep 17 00:00:00 2001
From: "Julien (juc) Castiaux" <juc@odoo.com>
Date: Wed, 7 Nov 2018 14:53:01 +0000
Subject: [PATCH] [FIX] purchase: access forbidden for product image on order
 line

When a user accesses a PO through the portal thanks to an access token
(without being connected), the product image on each order line is
rendered using the image placeholder with a size of 48x48.

This raises a 403 Forbidden at image retrieval since the access token is
not passed as a parameter. This commit corrects that behavior by sending
the resized image along with the rendering of the template instead of an
url.

Another solution could be to generalize the access token check to any
model in:
https://github.com/odoo/odoo/blob/12.0/odoo/addons/base/models/ir_http.py#L303-L311

But this seems overkill regarding this specific error.

opw-1902741

closes odoo/odoo#28479
---
 addons/purchase/controllers/portal.py      | 3 +++
 addons/purchase/views/portal_templates.xml | 2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/addons/purchase/controllers/portal.py b/addons/purchase/controllers/portal.py
index 400b6ed51fa..f718a9e4c02 100644
--- a/addons/purchase/controllers/portal.py
+++ b/addons/purchase/controllers/portal.py
@@ -2,10 +2,12 @@
 # Part of Odoo. See LICENSE file for full copyright and licensing details.
 
 from collections import OrderedDict
+from functools import partial
 
 from odoo import http
 from odoo.exceptions import AccessError, MissingError
 from odoo.http import request
+from odoo.tools import image_resize_image
 from odoo.tools.translate import _
 from odoo.addons.portal.controllers.portal import pager as portal_pager, CustomerPortal
 
@@ -22,6 +24,7 @@ class CustomerPortal(CustomerPortal):
     def _purchase_order_get_page_view_values(self, order, access_token, **kwargs):
         values = {
             'order': order,
+            'resize_to_48': partial(image_resize_image, size=(48, 48)),
         }
         return self._get_page_view_values(order, access_token, values, 'my_purchases_history', True, **kwargs)
 
diff --git a/addons/purchase/views/portal_templates.xml b/addons/purchase/views/portal_templates.xml
index 5b57b343ccd..c125d4e18a8 100644
--- a/addons/purchase/views/portal_templates.xml
+++ b/addons/purchase/views/portal_templates.xml
@@ -95,7 +95,7 @@
               <t t-foreach="order.order_line" t-as="ol">
                 <div class="row purchases_vertical_align">
                   <div class="col-lg-1 text-center">
-                      <img t-att-src="'/web/image/purchase.order.line/%s/product_image/48x48' % ol.id" alt="Product"/>
+                      <img t-att-src="image_data_uri(resize_to_48(ol.product_id.image))" alt="Product"/>
                   </div>
                   <div id='product_name' class="col-lg-5">
                     <span t-esc="ol.product_id.name"/>