From 9f86de81bc2bd7026b2c9e34813fc8e72c7235cf Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=A9ry=20Debongnie?= Date: Thu, 15 Oct 2015 11:58:34 +0200 Subject: [PATCH] [FIX] mail: fix permission issue when starring/marking messages If a user does not have write permissions on a model, he should still be able to remove himself from the many2many relation. This caused a problem: some messages could not be modified by a user (star/unstar or mark as read) --- addons/mail/models/mail_message.py | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/addons/mail/models/mail_message.py b/addons/mail/models/mail_message.py index 76936a961c1..b4b0e6fc83d 100644 --- a/addons/mail/models/mail_message.py +++ b/addons/mail/models/mail_message.py @@ -150,12 +150,18 @@ class Message(models.Model): def set_message_needaction(self, partner_ids=None): if not partner_ids: partner_ids = [self.env.user.partner_id.id] + if set(partner_ids) == set([self.env.user.partner_id.id]): + # a user should be able to mark a message as needaction for him + self = self.sudo() return self.write({'needaction_partner_ids': [(4, pid) for pid in partner_ids]}) @api.multi def set_message_done(self, partner_ids=None): if not partner_ids: partner_ids = [self.env.user.partner_id.id] + if set(partner_ids) == set([self.env.user.partner_id.id]): + # a user should be able to mark a message as done for him + self = self.sudo() return self.write({'needaction_partner_ids': [(3, pid) for pid in partner_ids]}) @api.multi @@ -167,10 +173,12 @@ class Message(models.Model): :param bool create_missing: create notifications for missing entries (i.e. when acting on displayed messages not notified) """ + # a user should always be able to star a message he can read + self.check_access_rule('read') if starred: - self.write({'starred_partner_ids': [(4, self.env.user.partner_id.id)]}) + self.sudo().write({'starred_partner_ids': [(4, self.env.user.partner_id.id)]}) else: - self.write({'starred_partner_ids': [(3, self.env.user.partner_id.id)]}) + self.sudo().write({'starred_partner_ids': [(3, self.env.user.partner_id.id)]}) return starred #------------------------------------------------------