From b795d69ce8aca2e88182c6d6d6b7af54d536f9dd Mon Sep 17 00:00:00 2001 From: Goffin Simon Date: Wed, 21 Dec 2016 11:57:04 +0100 Subject: [PATCH] [FIX] mail: Modifying followers in multi company In multi company, some followers of a document could be not readable for a user who has the rights to modify this document. If the user has the rights to write on a document, he is allowed to read and modify the followers of this document. opw:693536 --- addons/mail/controllers/main.py | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/addons/mail/controllers/main.py b/addons/mail/controllers/main.py index 8cc972fa13c..17f28807a64 100644 --- a/addons/mail/controllers/main.py +++ b/addons/mail/controllers/main.py @@ -114,7 +114,10 @@ class MailController(http.Controller): is_editable = request.env.user.has_group('base.group_no_one') partner_id = request.env.user.partner_id follower_id = None - for follower in request.env['mail.followers'].browse(follower_ids): + follower_recs = request.env['mail.followers'].sudo().browse(follower_ids) + res_ids = follower_recs.mapped('res_id') + request.env[res_model].browse(res_ids).check_access_rule("write") + for follower in follower_recs: is_uid = partner_id == follower.partner_id follower_id = follower.id if is_uid else follower_id followers.append({