pengyuthon/odoo_source
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[FIX] website: adapt /website/action to v14 perms

Browse Source 
As of v14 and #53335 (6c97a6d), access to `ir.actions*` models has been
restricted to admins, except in specific context such as via the
`/web/action/load` route.

This commit updates the `/website/action/` route to follow that logic,
and allow custom server actions to be exposed as "custom controllers".

The principle is that the action is located in a sudo environment, but
executed using the request environment. Access will only be permitted if
the model of the action is writable for the current user, or if any
action "groups" are set and the user belongs to one of them
(cfr f0d37c384b for that part).

closes odoo/odoo#62009

X-original-commit: ddf4c705ae0b83761495cd6a00d34463fa252043
Signed-off-by: Toufik Benjaa (tbe) <tbe@odoo.com>
This commit is contained in:
Olivier Dony
2020-11-19 11:50:31 +00:00
parent 3c3620be75
commit d16343a41d
1 changed files with 6 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
addons/website/controllers/main.py
+6 -6
View File
@@ -523,22 +523,22 @@ class Website(Home):
# find the action_id: either an xml_id, the path, or an ID
if isinstance(path_or_xml_id_or_id, str) and '.' in path_or_xml_id_or_id:
action = request.env.ref(path_or_xml_id_or_id, raise_if_not_found=False)
action = request.env.ref(path_or_xml_id_or_id, raise_if_not_found=False).sudo()
if not action:
action = ServerActions.search([('website_path', '=', path_or_xml_id_or_id), ('website_published', '=', True)], limit=1)
action = ServerActions.sudo().search(
[('website_path', '=', path_or_xml_id_or_id), ('website_published', '=', True)], limit=1)
if not action:
try:
action_id = int(path_or_xml_id_or_id)
action = ServerActions.sudo().browse(action_id).exists()
except ValueError:
pass
# check it effectively exists
if action_id:
action = ServerActions.browse(action_id).exists()
# run it, return only if we got a Response object
if action:
if action.state == 'code' and action.website_published:
action_res = action.run()
# use main session env for execution
action_res = ServerActions.browse(action.id).run()
if isinstance(action_res, werkzeug.wrappers.Response):
return action_res