From 8ea5637c1df66700def8b012515e603c8e31aa07 Mon Sep 17 00:00:00 2001 From: ThanhDodeurOdoo Date: Wed, 3 Oct 2018 15:34:13 +0200 Subject: [PATCH] [FIX] base: ir_http access mode Before the fix, routes using binary_content with access_mode and access_token didn't work properly since access_token was compared to the object's access token in all cases. This commit: -prevents the object's access_token check if access_mode is truthy (since access_mode does its own access_token check). -changes check_access_mode so it now returns a boolean instead of a record and is now private. Closes #27401 --- odoo/addons/base/models/ir_http.py | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/odoo/addons/base/models/ir_http.py b/odoo/addons/base/models/ir_http.py index 1fbd457be8d..5c457f5bd6e 100644 --- a/odoo/addons/base/models/ir_http.py +++ b/odoo/addons/base/models/ir_http.py @@ -247,7 +247,7 @@ class IrHttp(models.AbstractModel): return env.ref(xmlid, False) @classmethod - def check_access_mode(cls, env, id, access_mode, model, access_token=None, related_id=None): + def _check_access_mode(cls, env, id, access_mode, model, access_token=None, related_id=None): """ Implemented by each module to define an additional way to check access. @@ -256,9 +256,9 @@ class IrHttp(models.AbstractModel): :param access_mode: typically a string that describes the behaviour of the custom check :param model: the model of the object for which binary_content was called :param related_id: optional id to check security. - :return: the object or falsy result if not valid. + :return: True if the test passes, else False. """ - return None + return False @classmethod @@ -294,8 +294,6 @@ class IrHttp(models.AbstractModel): obj = None if xmlid: obj = cls._xmlid_to_obj(env, xmlid) - if access_mode: - obj = cls.check_access_mode(env, id, access_mode, model, access_token=access_token, related_id=related_id) elif id and model in env.registry: obj = env[model].browse(int(id)) # obj exists @@ -305,7 +303,11 @@ class IrHttp(models.AbstractModel): # access token grant access if model == 'ir.attachment' and access_token: obj = obj.sudo() - if not consteq(obj.access_token or '', access_token): + if access_mode: + if not cls._check_access_mode(env, id, access_mode, model, access_token=access_token, + related_id=related_id): + return (403, [], None) + elif not consteq(obj.access_token or '', access_token): return (403, [], None) # check read access