From dbd5cb48e29eea5a6ed09cf736b706615ce8b3e0 Mon Sep 17 00:00:00 2001 From: Toufik Ben Jaa Date: Mon, 26 Nov 2018 10:42:37 +0000 Subject: [PATCH] [FIX] mail: check access rights on models when fetching messages - When fetching messages (e.g. opening discuss), we do not check if the model associated to a message is accessible for the current user. This could result to access rights error messages when trying to read the main attachment of the associated record. To avoid to triggers this errors, we first check if the current user has read access to the specific model, if so we try to read the record's main attachment. closes odoo/odoo#29025 --- addons/mail/models/mail_message.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/addons/mail/models/mail_message.py b/addons/mail/models/mail_message.py index 1a361177cd5..c2cad44ef97 100644 --- a/addons/mail/models/mail_message.py +++ b/addons/mail/models/mail_message.py @@ -390,7 +390,8 @@ class Message(models.Model): for notification in message.notification_ids.filtered(filter_notification): customer_email_data.append((partner_tree[notification.res_partner_id.id][0], partner_tree[notification.res_partner_id.id][1], notification.email_status)) - main_attachment = message.model and message.res_id and self.env[message.model].search([('id', '=',message.res_id)]) and getattr(self.env[message.model].browse(message.res_id), 'message_main_attachment_id') + has_access_to_model = message.model and self.env[message.model].check_access_rights('read', raise_exception=False) + main_attachment = has_access_to_model and message.res_id and self.env[message.model].search([('id', '=',message.res_id)]) and getattr(self.env[message.model].browse(message.res_id), 'message_main_attachment_id') attachment_ids = [] for attachment in message.attachment_ids: if attachment.id in attachments_tree: