From c68fa610d4e49eedd5f117675b973c551c771e75 Mon Sep 17 00:00:00 2001
From: Martin Trigaux <mat@odoo.com>
Date: Thu, 29 Jun 2023 12:12:28 +0000
Subject: [PATCH] [FIX] *: correctly search record without user

If a user is not present in the request, he is in no group at all and
can not access any model, including the one available for public
users.
Avoid ambiguity by using sudo or add a user specifically.

Part-of: odoo/odoo#125216
---
 addons/mail_plugin/tests/common.py | 3 ++-
 addons/website/models/res_users.py | 2 +-
 addons/website/models/website.py   | 2 +-
 odoo/addons/base/models/ir_http.py | 3 ++-
 odoo/addons/base/models/ir_qweb.py | 2 +-
 5 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/addons/mail_plugin/tests/common.py b/addons/mail_plugin/tests/common.py
index 98e8fcaebf4..400c3e57498 100644
--- a/addons/mail_plugin/tests/common.py
+++ b/addons/mail_plugin/tests/common.py
@@ -8,6 +8,7 @@ from unittest.mock import patch
 from odoo.addons.mail.tests.common import mail_new_test_user
 from odoo.http import request
 from odoo.tests.common import HttpCase
+from odoo import SUPERUSER_ID
 
 
 @contextmanager
@@ -19,7 +20,7 @@ def mock_auth_method_outlook(login):
     :param login: Login of the user used for the authentication
     """
     def patched_auth_method_outlook(*args, **kwargs):
-        request.update_env(user=request.env['res.users'].search([('login', '=', login)], limit=1))
+        request.update_env(user=request.env['res.users'].with_user(SUPERUSER_ID).search([('login', '=', login)], limit=1))
 
     with patch(
             'odoo.addons.mail_plugin.models.ir_http.IrHttp'
diff --git a/addons/website/models/res_users.py b/addons/website/models/res_users.py
index 10ebc1499e8..f6ab17e03fe 100644
--- a/addons/website/models/res_users.py
+++ b/addons/website/models/res_users.py
@@ -60,7 +60,7 @@ class ResUsers(models.Model):
 
     @api.model
     def _get_signup_invitation_scope(self):
-        current_website = self.env['website'].get_current_website()
+        current_website = self.env['website'].sudo().get_current_website()
         return current_website.auth_signup_uninvited or super(ResUsers, self)._get_signup_invitation_scope()
 
     @classmethod
diff --git a/addons/website/models/website.py b/addons/website/models/website.py
index c0d95a79b58..7f268f7d004 100644
--- a/addons/website/models/website.py
+++ b/addons/website/models/website.py
@@ -975,7 +975,7 @@ class Website(models.Model):
 
         # The format of `httprequest.host` is `domain:port`
         domain_name = request and request.httprequest.host or ''
-        website_id = self._get_current_website_id(domain_name, fallback=fallback)
+        website_id = self.sudo()._get_current_website_id(domain_name, fallback=fallback)
         return self.browse(website_id)
 
     @tools.ormcache('domain_name', 'fallback')
diff --git a/odoo/addons/base/models/ir_http.py b/odoo/addons/base/models/ir_http.py
index d5ab635a5f0..96706f90ab3 100644
--- a/odoo/addons/base/models/ir_http.py
+++ b/odoo/addons/base/models/ir_http.py
@@ -183,7 +183,8 @@ class IrHttp(models.AbstractModel):
         # verify the default language set in the context is valid,
         # otherwise fallback on the company lang, english or the first
         # lang installed
-        request.update_context(lang=get_lang(request.env)._get_cached('code'))
+        env = request.env if request.env.uid else request.env['base'].with_user(SUPERUSER_ID).env
+        request.update_context(lang=get_lang(env)._get_cached('code'))
 
     @classmethod
     def _dispatch(cls, endpoint):
diff --git a/odoo/addons/base/models/ir_qweb.py b/odoo/addons/base/models/ir_qweb.py
index 91a179b1c9f..71a17884eec 100644
--- a/odoo/addons/base/models/ir_qweb.py
+++ b/odoo/addons/base/models/ir_qweb.py
@@ -2425,7 +2425,7 @@ class IrQWeb(models.AbstractModel):
         If debug=assets, the assets will be regenerated when a file which composes them has been modified.
         Else, the assets will be generated only once and then stored in cache.
         """
-        rtl = self.env['res.lang']._lang_get_direction(self.env.context.get('lang') or self.env.user.lang) == 'rtl'
+        rtl = self.env['res.lang'].sudo()._lang_get_direction(self.env.context.get('lang') or self.env.user.lang) == 'rtl'
         assets_params = self.env['ir.asset']._get_asset_params() # website_id
         debug_assets = debug and 'assets' in debug