From cdffc4db54e7f385bd2a283f91ae2e65b1268bd7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thibault=20Delavall=C3=A9e?= Date: Tue, 28 May 2013 16:44:47 +0200 Subject: [PATCH] [FIX] project_issue: fixed write of date_action_last: it is possible to post a message without having access to write access rights on an issue, therefore using SUPERUSER_ID (e.g. portal user). [FIX] mail_message, mail, project, task, issue: it is now possible to have model-specific access rule checking for mail.message related acces right / rules. Task and issue allow to create mail.message when the user has a read access on the related document, not only when having write access. bzr revid: tde@openerp.com-20130528144447-3ivcom6r9x7q949b --- addons/mail/mail_message.py | 8 +++----- addons/mail/mail_thread.py | 14 ++++++++++++++ addons/project/project.py | 13 ++++++++++++- addons/project_issue/project_issue.py | 19 ++++++++++++++----- 4 files changed, 43 insertions(+), 11 deletions(-) diff --git a/addons/mail/mail_message.py b/addons/mail/mail_message.py index 979d4d7f3b8..b8a00a790a8 100644 --- a/addons/mail/mail_message.py +++ b/addons/mail/mail_message.py @@ -725,12 +725,10 @@ class mail_message(osv.Model): for model, doc_dict in model_record_ids.items(): model_obj = self.pool[model] mids = model_obj.exists(cr, uid, doc_dict.keys()) - if operation in ['create', 'write', 'unlink']: - model_obj.check_access_rights(cr, uid, 'write') - model_obj.check_access_rule(cr, uid, mids, 'write', context=context) + if hasattr(model_obj, 'check_mail_message_access'): + model_obj.check_mail_message_access(cr, uid, mids, operation, context=context) else: - model_obj.check_access_rights(cr, uid, operation) - model_obj.check_access_rule(cr, uid, mids, operation, context=context) + self.pool['mail.thread'].check_mail_message_access(cr, uid, mids, operation, model_obj=model_obj, context=context) document_related_ids += [mid for mid, message in message_values.iteritems() if message.get('model') == model and message.get('res_id') in mids] diff --git a/addons/mail/mail_thread.py b/addons/mail/mail_thread.py index 5edc2f436d5..0ca6a75db85 100644 --- a/addons/mail/mail_thread.py +++ b/addons/mail/mail_thread.py @@ -449,6 +449,20 @@ class mail_thread(osv.AbstractModel): ir_attachment_obj.unlink(cr, uid, attach_ids, context=context) return True + def check_mail_message_access(self, cr, uid, mids, operation, model_obj=None, context=None): + """ mail.message check permission rules for related document. This method is + meant to be inherited in order to implement addons-specific behavior. + A common behavior would be to allow creating messages when having read + access rule on the document, for portal document such as issues. """ + if not model_obj: + model_obj = self + if operation in ['create', 'write', 'unlink']: + model_obj.check_access_rights(cr, uid, 'write') + model_obj.check_access_rule(cr, uid, mids, 'write', context=context) + else: + model_obj.check_access_rights(cr, uid, operation) + model_obj.check_access_rule(cr, uid, mids, operation, context=context) + #------------------------------------------------------ # Email specific #------------------------------------------------------ diff --git a/addons/project/project.py b/addons/project/project.py index f6480813b70..23fca695b6b 100644 --- a/addons/project/project.py +++ b/addons/project/project.py @@ -1197,6 +1197,17 @@ class task(base_stage, osv.osv): return [task.project_id.message_get_reply_to()[0] if task.project_id else False for task in self.browse(cr, uid, ids, context=context)] + def check_mail_message_access(self, cr, uid, mids, operation, model_obj=None, context=None): + """ mail.message document permission rule: can post a new message if can read + because of portal document. """ + if not model_obj: + model_obj = self + if operation == 'create': + model_obj.check_access_rights(cr, uid, 'read') + model_obj.check_access_rule(cr, uid, mids, 'read', context=context) + else: + return super(task, self).check_mail_message_access(cr, uid, mids, operation, model_obj=model_obj, context=context) + def message_new(self, cr, uid, msg, custom_values=None, context=None): """ Override to updates the document according to the email. """ if custom_values is None: custom_values = {} @@ -1205,7 +1216,7 @@ class task(base_stage, osv.osv): 'planned_hours': 0.0, } defaults.update(custom_values) - return super(task,self).message_new(cr, uid, msg, custom_values=defaults, context=context) + return super(task, self).message_new(cr, uid, msg, custom_values=defaults, context=context) def message_update(self, cr, uid, ids, msg, update_vals=None, context=None): """ Override to update the task according to the email. """ diff --git a/addons/project_issue/project_issue.py b/addons/project_issue/project_issue.py index 151bb2ab22e..bd5dff89413 100644 --- a/addons/project_issue/project_issue.py +++ b/addons/project_issue/project_issue.py @@ -19,6 +19,7 @@ # ############################################################################## +from openerp import SUPERUSER_ID from openerp.addons.base_status.base_stage import base_stage from openerp.addons.project.project import _TASK_STATE from openerp.addons.crm import crm @@ -492,6 +493,17 @@ class project_issue(base_stage, osv.osv): return [issue.project_id.message_get_reply_to()[0] if issue.project_id else False for issue in self.browse(cr, uid, ids, context=context)] + def check_mail_message_access(self, cr, uid, mids, operation, model_obj=None, context=None): + """ mail.message document permission rule: can post a new message if can read + because of portal document. """ + if not model_obj: + model_obj = self + if operation == 'create': + model_obj.check_access_rights(cr, uid, 'read') + model_obj.check_access_rule(cr, uid, mids, 'read', context=context) + else: + return super(project_issue, self).check_mail_message_access(cr, uid, mids, operation, model_obj=model_obj, context=context) + def message_get_suggested_recipients(self, cr, uid, ids, context=None): recipients = super(project_issue, self).message_get_suggested_recipients(cr, uid, ids, context=context) try: @@ -563,13 +575,10 @@ class project_issue(base_stage, osv.osv): """ if context is None: context = {} - res = super(project_issue, self).message_post(cr, uid, thread_id, body=body, subject=subject, type=type, subtype=subtype, parent_id=parent_id, attachments=attachments, context=context, content_subtype=content_subtype, **kwargs) - if thread_id: - self.write(cr, uid, thread_id, {'date_action_last': time.strftime(tools.DEFAULT_SERVER_DATETIME_FORMAT)}, context=context) - - return res + self.write(cr, SUPERUSER_ID, thread_id, {'date_action_last': time.strftime(tools.DEFAULT_SERVER_DATETIME_FORMAT)}, context=context) + return res class project(osv.Model):