[FIX] mail: don't self-notify

Forward port fixes done in stable versions and not correclty forward ported
into master at merge time.

LINKS

Task ID-2421795
PR odoo/odoo#63677

X-Original-commit odoo/odoo@340f6baf61
X-Original-Task ID-2348333

X-original-commit: 6c1ed107d9d4144ba078ae0216cf8dcdf02d8a7f

addons/mail/i18n/mail.pot

@@ -1562,6 +1562,12 @@ msgstr ""
 msgid "Customer is required for inbox / email notification"
 msgstr ""
 
+#. module: mail
+#: code:addons/mail/models/mail_notification.py:0
+#, python-format
+msgid "Can not update the message or recipient of a notification."
+msgstr ""
+
 #. module: mail
 #: model:ir.model.fields,field_description:mail.field_mail_mail__date
 #: model:ir.model.fields,field_description:mail.field_mail_message__date

addons/mail/models/mail_notification.py

@@ -4,6 +4,7 @@
 from dateutil.relativedelta import relativedelta
 
 from odoo import api, fields, models
+from odoo.exceptions import AccessError
 from odoo.tools.translate import _
 
 
@@ -58,12 +59,17 @@ class MailNotification(models.Model):
 
     @api.model_create_multi
     def create(self, vals_list):
+        messages = self.env['mail.message'].browse(vals['mail_message_id'] for vals in vals_list)
+        messages.check_access_rights('read')
+        messages.check_access_rule('read')
         for vals in vals_list:
             if vals.get('is_read'):
                 vals['read_date'] = fields.Datetime.now()
         return super(MailNotification, self).create(vals_list)
 
     def write(self, vals):
+        if ('mail_message_id' in vals or 'res_partner_id' in vals) and not self.env.is_admin():
+            raise AccessError(_("Can not update the message or recipient of a notification."))
         if vals.get('is_read'):
             vals['read_date'] = fields.Datetime.now()
         return super(MailNotification, self).write(vals)