From afef0b390f0f9ef3eee4c5a22e584fec3c59505e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?R=C3=A9my=20Voet=20=28ryv=29?= Date: Mon, 25 Sep 2023 12:25:29 +0200 Subject: [PATCH] [FIX] mail: allow searching on `message_partner_ids` for portal Because we now check groups in the domain, some searches raise `AccessError` when using `message_partner_ids` in the domain for the portal user: - https://github.com/odoo/odoo/blob/4d1a1f1c99d6055b60921ce464b72f0f4d9bbfe2/addons/sale/controllers/portal.py#L35 - https://github.com/odoo/odoo/blob/4d1a1f1c99d6055b60921ce464b72f0f4d9bbfe2/addons/sale/controllers/portal.py#L41 - https://github.com/odoo/odoo/blob/ba1a5509fa49fd846739252d16083dd8cb334b53/addons/website_forum/models/forum_post.py#L831 - https://github.com/odoo/odoo/blob/86b43bcfa6c9a5b6ac1b3ac9ba0c308f1169ea3b/addons/hr_timesheet/models/hr_timesheet.py#L41 Since there are many invalid domains and it is impossible to sudo only part of the domain, it is easier to override `_flush_search` to allow `message_partner_ids` in search domain leafs with some restriction. closes odoo/odoo#135111 Related: odoo/enterprise#47822 Signed-off-by: Raphael Collet --- addons/crm/tests/test_performances.py | 2 +- addons/mail/models/mail_thread.py | 25 ++++++++++++++++++++++++- 2 files changed, 25 insertions(+), 2 deletions(-) diff --git a/addons/crm/tests/test_performances.py b/addons/crm/tests/test_performances.py index bbb4bfa84d9..05afb8af4ce 100644 --- a/addons/crm/tests/test_performances.py +++ b/addons/crm/tests/test_performances.py @@ -95,7 +95,7 @@ class TestLeadAssignPerf(TestLeadAssignCommon): # randomness: at least 1 query with self.with_user('user_sales_manager'): - with self.assertQueryCount(user_sales_manager=583): # crm 582 + with self.assertQueryCount(user_sales_manager=584): # crm 582 self.env['crm.team'].browse(self.sales_teams.ids)._action_assign_leads(work_days=2) # teams assign diff --git a/addons/mail/models/mail_thread.py b/addons/mail/models/mail_thread.py index a26fc7fbd6f..76fb842062f 100644 --- a/addons/mail/models/mail_thread.py +++ b/addons/mail/models/mail_thread.py @@ -92,7 +92,8 @@ class MailThread(models.AbstractModel): compute='_compute_message_partner_ids', inverse='_inverse_message_partner_ids', search='_search_message_partner_ids', - groups='base.group_user') + groups='base.group_user', + ) message_ids = fields.One2many( 'mail.message', 'res_id', string='Messages', domain=lambda self: [('message_type', '!=', 'user_notification')], auto_join=True) @@ -389,6 +390,28 @@ class MailThread(models.AbstractModel): return super().get_empty_list_help(help_message) + def _flush_search(self, domain, fields=None, order=None, seen=None): + """ Override _flush_search in order to relax field groups security + check on `message_partner_ids`. Accept portal user to filter + threads by themselves as followers. + """ + if self.env.su or self.user_has_groups('base.group_user'): + return super()._flush_search(domain, fields, order, seen) + + domain = list(domain) + for i, leaf in enumerate(domain): + if len(leaf) != 3 or leaf[0] != 'message_partner_ids': + continue + user_partner = self.env.user.partner_id + allow_partner_ids = set((user_partner | user_partner.commercial_partner_id).ids) + operand = leaf[2] if isinstance(leaf[2], (list, tuple)) else [leaf[2]] + if not allow_partner_ids.issuperset(operand): + raise AccessError("Portal users can only filter threads by themselves as followers.") + # Replace the leaf with dummy leaf + domain[i] = expression.TRUE_LEAF + + return super()._flush_search(domain, fields, order, seen) + # ------------------------------------------------------ # MODELS / CRUD HELPERS # ------------------------------------------------------