From d16343a41dd711744a0fdea1f94658cee3f6c2d0 Mon Sep 17 00:00:00 2001 From: Olivier Dony Date: Tue, 17 Nov 2020 14:04:08 +0000 Subject: [PATCH] [FIX] website: adapt /website/action to v14 perms As of v14 and #53335 (6c97a6d), access to `ir.actions*` models has been restricted to admins, except in specific context such as via the `/web/action/load` route. This commit updates the `/website/action/` route to follow that logic, and allow custom server actions to be exposed as "custom controllers". The principle is that the action is located in a sudo environment, but executed using the request environment. Access will only be permitted if the model of the action is writable for the current user, or if any action "groups" are set and the user belongs to one of them (cfr f0d37c384b299e5f35cddda02d3f56c6ad37a9a7 for that part). closes odoo/odoo#62009 X-original-commit: ddf4c705ae0b83761495cd6a00d34463fa252043 Signed-off-by: Toufik Benjaa (tbe) --- addons/website/controllers/main.py | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/addons/website/controllers/main.py b/addons/website/controllers/main.py index c94075e946b..374438b32c0 100644 --- a/addons/website/controllers/main.py +++ b/addons/website/controllers/main.py @@ -523,22 +523,22 @@ class Website(Home): # find the action_id: either an xml_id, the path, or an ID if isinstance(path_or_xml_id_or_id, str) and '.' in path_or_xml_id_or_id: - action = request.env.ref(path_or_xml_id_or_id, raise_if_not_found=False) + action = request.env.ref(path_or_xml_id_or_id, raise_if_not_found=False).sudo() if not action: - action = ServerActions.search([('website_path', '=', path_or_xml_id_or_id), ('website_published', '=', True)], limit=1) + action = ServerActions.sudo().search( + [('website_path', '=', path_or_xml_id_or_id), ('website_published', '=', True)], limit=1) if not action: try: action_id = int(path_or_xml_id_or_id) + action = ServerActions.sudo().browse(action_id).exists() except ValueError: pass - # check it effectively exists - if action_id: - action = ServerActions.browse(action_id).exists() # run it, return only if we got a Response object if action: if action.state == 'code' and action.website_published: - action_res = action.run() + # use main session env for execution + action_res = ServerActions.browse(action.id).run() if isinstance(action_res, werkzeug.wrappers.Response): return action_res