From d00a832952a0b9d2276a1f057ee10152b0c7f5bc Mon Sep 17 00:00:00 2001 From: Jorge Pinna Puissant Date: Fri, 11 Oct 2019 14:11:40 +0000 Subject: [PATCH] [FIX] website: access to themes images Since 62c9dedafda0cbdc618641eaa80c49535ab0b5f6, when accessing a website connected as portal or public user, the themes images are not showed. An error is arose 'Sorry, you are not allowed to access documents of type 'Attachment' (ir.attachment)'. Now, the portal and public user have access to the themes images. opw-2082468 closes odoo/odoo#39025 X-original-commit: 9b8c390cd5526556346356f260a9cfe1b90cd510 Signed-off-by: Jorge Pinna Puissant (jpp) Co-authored-by: Lucas Perais --- addons/website/models/ir_http.py | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/addons/website/models/ir_http.py b/addons/website/models/ir_http.py index de6d88cbbba..c7b2dbc62ae 100644 --- a/addons/website/models/ir_http.py +++ b/addons/website/models/ir_http.py @@ -329,7 +329,12 @@ class Http(models.AbstractModel): def _xmlid_to_obj(cls, env, xmlid): website_id = env['website'].get_current_website() if website_id and website_id.theme_id: - obj = env['ir.attachment'].search([('key', '=', xmlid), ('website_id', '=', website_id.id)]) + domain = [('key', '=', xmlid), ('website_id', '=', website_id.id)] + Attachment = env['ir.attachment'] + if request.env.user.share: + domain.append(('public', '=', True)) + Attachment = Attachment.sudo() + obj = Attachment.search(domain) if obj: return obj[0]