From a4c67f2b9ed619a1dc5a386ea34e5bbde3fbb12b Mon Sep 17 00:00:00 2001
From: Nicolas Martinelli <nim@odoo.com>
Date: Mon, 31 Oct 2016 15:23:12 +0100
Subject: [PATCH] [FIX] website_quote: tokenized link in portal

When a user has access to a quote (because he is follower) but he is not
in the same company than the customer, an access error can occur on the
the rendering of the partner field.

We use the tokenized link instead, which will read the SO as a superuser
to avoid this situation.

opw-691740
---
 addons/website_quote/views/website_quotation.xml | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/addons/website_quote/views/website_quotation.xml b/addons/website_quote/views/website_quotation.xml
index 5453719966a..cd7b7616cad 100644
--- a/addons/website_quote/views/website_quotation.xml
+++ b/addons/website_quote/views/website_quotation.xml
@@ -692,7 +692,12 @@
           <t t-foreach="quotations" t-as="quotation">
               <tr>
                   <td>
-                      <a t-attf-href="/quote/#{quotation.id}?#{keep_query()}"><t t-esc="quotation.name"/></a>
+                      <t t-if="quotation.sudo().partner_id.commercial_partner_id != request.env.user.partner_id.commercial_partner_id and request.env.user.share">
+                          <a t-attf-href="/quote/#{quotation.id}/#{quotation.access_token}?#{keep_query()}"><t t-esc="quotation.name"/></a>
+                      </t>
+                      <t t-if="not (quotation.sudo().partner_id.commercial_partner_id != request.env.user.partner_id.commercial_partner_id and request.env.user.share)">
+                          <a t-attf-href="/quote/#{quotation.id}?#{keep_query()}"><t t-esc="quotation.name"/></a>
+                      </t>
                   </td>
                   <td><span t-field="quotation.validity_date"/></td>
                       <td>