From d0a855985f7782a64c081b2cf4a0b0c22e488950 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thibault=20Delavall=C3=A9e?= Date: Tue, 28 Apr 2020 08:24:16 +0000 Subject: [PATCH] [FIX] website_slides: allow portal users to read their own reviews with attachment Followup of 86c80d341846894c435b1c8f61ef946b06e72ec7 : currently portal users face an access issue if they try to read their full review with attachments. This commit fixes that by sudo-ing access to the attachment as other access is already granted. Task ID 2214795 X-original-commit: ad7cd4bd38fdb0d92b22bb979637bb5623621378 --- addons/website_slides/controllers/main.py | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/addons/website_slides/controllers/main.py b/addons/website_slides/controllers/main.py index ba2a8440753..385d7b572b1 100644 --- a/addons/website_slides/controllers/main.py +++ b/addons/website_slides/controllers/main.py @@ -463,9 +463,13 @@ class WebsiteSlides(WebsiteProfile): last_message_values = last_message.read(['body', 'rating_value', 'attachment_ids'])[0] last_message_attachment_ids = last_message_values.pop('attachment_ids', []) if last_message_attachment_ids: - last_message_attachment_ids = json.dumps(request.env['ir.attachment'].browse(last_message_attachment_ids).read( - ['id', 'name', 'mimetype', 'file_size', 'access_token'] - )) + # use sudo as portal user cannot read access_token, necessary for updating attachments + # through frontend chatter -> access is already granted and limited to current user message + last_message_attachment_ids = json.dumps( + request.env['ir.attachment'].sudo().browse(last_message_attachment_ids).read( + ['id', 'name', 'mimetype', 'file_size', 'access_token'] + ) + ) else: last_message_values = {} last_message_attachment_ids = []