From ceeba05d70a6df217d4cc431fe726ae55811f8c3 Mon Sep 17 00:00:00 2001 From: Toufik Benjaa Date: Thu, 26 Apr 2018 14:57:40 +0200 Subject: [PATCH] [FIX] website_quote: Do not raise exception when quotation viewed - When a quotation if viewed by a customer, a note is posted in the quotation's chatter saying "Quotation viewed by customer". This is causes issues if the quotation is accessed without the access token and by a partner that do not have the rights to write on the model "sale.order". To address this issue we provide to the "_message_post_helper" function the sale order's access token to bypass the accesses checks. OPW-1839183 --- addons/website_quote/controllers/main.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/addons/website_quote/controllers/main.py b/addons/website_quote/controllers/main.py index 7b892f53fcc..bc5a3414414 100644 --- a/addons/website_quote/controllers/main.py +++ b/addons/website_quote/controllers/main.py @@ -50,7 +50,7 @@ class sale_quote(http.Controller): if Order and request.session.get('view_quote_%s' % Order.id) != now and request.env.user.share: request.session['view_quote_%s' % Order.id] = now body = _('Quotation viewed by customer') - _message_post_helper(res_model='sale.order', res_id=Order.id, message=body, token=token, message_type='notification', subtype="mail.mt_note", partner_ids=Order.user_id.sudo().partner_id.ids) + _message_post_helper(res_model='sale.order', res_id=Order.id, message=body, token=Order.access_token, message_type='notification', subtype="mail.mt_note", partner_ids=Order.user_id.sudo().partner_id.ids) if not Order: return request.render('website.404')