From a3cd0ac2ceaa25cc7ddbbb38e33a43726a0c7ac7 Mon Sep 17 00:00:00 2001
From: Xavier Morel <xmo@odoo.com>
Date: Thu, 6 Sep 2018 16:44:00 +0200
Subject: [PATCH] [FIX] project: add access token to task attachment display

Following CDN expansion (d98b262398fcf5d14d8e0acd4015a6fb28573155)
portal attachment links now go through the CDN, which is an issue for
restricted-access attachments e.g. attachments bound to specific objects
(such as support tickets).

Add an access token to the attachment links in the /my/task template.

Cf OPW-1882014 (fixed ad-hoc by editing the relevant view on odoo.com)
---
 addons/project/views/project_portal_templates.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/addons/project/views/project_portal_templates.xml b/addons/project/views/project_portal_templates.xml
index 1f24df5cef8..792c1eacfd3 100644
--- a/addons/project/views/project_portal_templates.xml
+++ b/addons/project/views/project_portal_templates.xml
@@ -211,7 +211,7 @@
                                 </strong>
                                 <div class='row'>
                                     <div class="col-md-2 col-sm-3 text-center oe_attachments" t-foreach='task.attachment_ids' t-as='attachment'>
-                                        <a t-attf-href="/web/content/#{attachment.id}?download=true" target="_blank">
+                                        <a t-attf-href="/web/content/#{attachment.id}?download=true&amp;access_token=#{attachment.generate_access_token()}" target="_blank">
                                             <div class='oe_attachment_embedded o_image o_image_small' t-att-title="attachment.name" t-att-data-mimetype="attachment.mimetype" t-attf-data-src="/web/image/#{attachment.id}/50x40"/>
                                             <div class='oe_attachment_name'><t t-esc='attachment.name' /></div>
                                         </a>