[FIX] portal, *: display avatar when read access right are fulfilled

*: test_mail_full, website_blog

Steps to reproduce the bug:
- Enable the comments on a blog.
- Add a comment.

-> Problem: The avatar of the comment is the default placeholder image.

The problem appears since [1]. This commit was created to bypass the
read access of an image if a correct `token` was provided in the dataset
of the `.o_portal_chatter` element. The problem is that since [1], if
the `.o_portal_chatter` element does not have a `token` (or a `hash` and
a `pid` since [2]) in its dataset, the avatar images are displayed as
the default placeholder image by default. The goal of this commit is to
correct this behavior; if there is no token provided, the previously
used `/web/image` route is used to show the avatar. Thanks to this
route, the avatar is displayed if the read access is fulfilled. If it is
not the case, the default placeholder image is displayed.

[1]: https://github.com/odoo/odoo/commit/d4eb996cd3caea3fbb822437057a6a5a8a722293
[2]: https://github.com/odoo/odoo/commit/7f69708bcce3b3c4b096d89cb0ec354998eac191

opw-3749422

closes odoo/odoo#160240

X-original-commit: https://github.com/odoo/odoo/commit/c65cffd6447afce65a45a38690c003e84afd63d9
Signed-off-by: Romain Derie (rde) <rde@odoo.com>
Signed-off-by: Colin Louis (loco) <loco@odoo.com>

addons/portal/models/mail_message.py

@@ -99,7 +99,7 @@ class MailMessage(models.Model):
                 elif options and options.keys() >= {"hash", "pid"}:
                     values['author_avatar_url'] = f'/mail/avatar/mail.message/{message.id}/author_avatar/50x50?_hash={options["hash"]}&pid={options["pid"]}'
                 else:
-                    values['author_avatar_url'] = f'/mail/avatar/mail.message/{message.id}/author_avatar/50x50'
+                    values['author_avatar_url'] = f'/web/image/mail.message/{message.id}/author_avatar/50x50'
             if 'is_message_subtype_note' in properties_names:
                 values['is_message_subtype_note'] = (values.get('subtype_id') or [False, ''])[0] == note_id
             if 'published_date_str' in properties_names:

addons/test_mail_full/tests/test_mail_performance.py

@@ -272,7 +272,7 @@ class TestPortalFormatPerformance(FullBaseMailPerformance):
                 ]
             )
             self.assertEqual(format_res['author_id'], (record.customer_id.id, record.customer_id.display_name))
-            self.assertEqual(format_res['author_avatar_url'], f'/mail/avatar/mail.message/{message.id}/author_avatar/50x50')
+            self.assertEqual(format_res['author_avatar_url'], f'/web/image/mail.message/{message.id}/author_avatar/50x50')
             self.assertEqual(format_res['date'], datetime(2023, 5, 15, 10, 30, 5))
             self.assertEqual(format_res['published_date_str'], 'May 15, 2023, 10:30:05 AM')
             self.assertEqual(format_res['id'], message.id)

addons/website_blog/static/tests/tours/blog_tags_tour.js

@@ -10,8 +10,8 @@ wTourUtils.registerWebsitePreviewTour('blog_tags', {
     test: true,
     url: '/blog',
 }, () => [{
-        content: "Go to first blog",
-        trigger: "iframe article[name=blog_post] a",
+        content: "Go to the 'Post Test' blog",
+        trigger: "iframe article[name=blog_post] a:contains('Post Test')",
     },
     ...wTourUtils.clickOnEditAndWaitEditMode(),
     wTourUtils.clickOnSnippet('#o_wblog_post_top .o_wblog_post_page_cover'),

addons/website_blog/tests/test_ui.py

@@ -2,10 +2,11 @@
 # Part of Odoo. See LICENSE file for full copyright and licensing details.
 
 import odoo.tests
+from odoo.addons.website_blog.tests.common import TestWebsiteBlogCommon
 
 
 @odoo.tests.tagged('post_install', '-at_install')
-class TestWebsiteBlogUi(odoo.tests.HttpCase):
+class TestWebsiteBlogUi(odoo.tests.HttpCase, TestWebsiteBlogCommon):
     @classmethod
     def setUpClass(cls):
         super().setUpClass()
@@ -50,3 +51,17 @@ class TestWebsiteBlogUi(odoo.tests.HttpCase):
         self.env.ref('website_blog.opt_blog_sidebar_show').active = True
         self.env.ref('website_blog.opt_sidebar_blog_index_follow_us').active = False
         self.start_tour("/blog", 'blog_autocomplete_with_date')
+
+    def test_avatar_comment(self):
+        mail_message = self.env['mail.message'].create({
+            'author_id': self.user_public.partner_id.id,
+            'model': self.test_blog_post._name,
+            'res_id': self.test_blog_post.id,
+            'subtype_id': self.ref('mail.mt_comment'),
+        })
+        portal_message = mail_message.portal_message_format()
+        response = self.url_open(portal_message[0]['author_avatar_url'])
+        # Ensure that the avatar is visible
+        self.assertEqual(response.status_code, 200)
+        self.assertEqual(response.headers.get('Content-Type'), 'image/png')
+        self.assertRegex(response.headers.get('Content-Disposition', ''), r'mail_message-\d+-author_avatar\.png')