pengyuthon/odoo_source
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[FIX] website_slides: allow portal users to read their own reviews with attachment

Browse Source 
Followup of 86c80d341846894c435b1c8f61ef946b06e72ec7 : currently portal users face an access issue
if they try to read their full review with attachments. This commit fixes that
by sudo-ing access to the attachment as other access is already granted.

Task ID 2214795

X-original-commit: ad7cd4bd38fdb0d92b22bb979637bb5623621378
This commit is contained in:
Thibault Delavallée
2020-05-07 09:03:24 +00:00
parent 7252713eac
commit d0a855985f
1 changed files with 7 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
addons/website_slides/controllers/main.py
+7 -3
View File
@@ -463,9 +463,13 @@ class WebsiteSlides(WebsiteProfile):
last_message_values = last_message.read(['body', 'rating_value', 'attachment_ids'])[0]
last_message_attachment_ids = last_message_values.pop('attachment_ids', [])
if last_message_attachment_ids:
last_message_attachment_ids = json.dumps(request.env['ir.attachment'].browse(last_message_attachment_ids).read(
['id', 'name', 'mimetype', 'file_size', 'access_token']
))
# use sudo as portal user cannot read access_token, necessary for updating attachments
# through frontend chatter -> access is already granted and limited to current user message
last_message_attachment_ids = json.dumps(
request.env['ir.attachment'].sudo().browse(last_message_attachment_ids).read(
['id', 'name', 'mimetype', 'file_size', 'access_token']
)
)
else:
last_message_values = {}
last_message_attachment_ids = []