From e725ba761f33f3d949f1c478fa25fd5ea12df50f Mon Sep 17 00:00:00 2001 From: Pierre-Yves Dufays Date: Wed, 8 Feb 2023 13:23:51 +0000 Subject: [PATCH] [FIX] mail: allow post on model with readonly access when authorized The attribute _mail_post_access='read' on a model class allows to post on that model with readonly access. But when providing an attachment such action was throwing a security error due to the check done on the attachment. Indeed adding an attachment to a model is modifying that model so the write access is needed. To solve this problem, we add the attachment in sudo in the '_message_post_process_attachments' method. Justification This is an internal method and we have stated in its documentation that it is the caller responsibility to check the rights. Actually, the checks are done at mail.message creation (to which the attachment are linked) by the override of 'check_access_rule' which calls '_get_mail_message_access' which takes into account that attribute (_mail_post_access). Moreover sudo is already used in '_message_post_process_attachments' to link existing attachments. Here we add a sudo for the new attachments as well. Note This fix allows the test 'test_post_with_read_access' to pass (located in test_mail/tests/test_mail_multi_company.py). But it is currently hard to reproduce functionally as - answering an email works as it is executed by the cron; - replying in discuss trigger a multi company error no matter there is an attachment or not (so it is another problem); - sending a message (with readonly access) on a thread from the interface works without this fix because the attachment are created beforehand and the part that handle already existing attachment is already in sudo; Multicompany issues will be solved in the next commits. Task-3178885 (Mail: fix 'readonly' post support) X-original-commit: odoo/odoo@f9a6f7f7ce58ad13fdfd992815746855b7d4f7c9 Part-of: odoo/odoo#114511 --- addons/mail/models/mail_thread.py | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/addons/mail/models/mail_thread.py b/addons/mail/models/mail_thread.py index b227f486e8c..561ed795097 100644 --- a/addons/mail/models/mail_thread.py +++ b/addons/mail/models/mail_thread.py @@ -2082,6 +2082,13 @@ class MailThread(models.AbstractModel): content (body) through CIDs body is updated. CIDs are found and replaced by links to web/image as CIDs are not supported as it. + Note that attachments are created/written in sudo as we consider at this + point access is granted on related record and/or to post the linked + message. The caller must verify the access rights accordingly. Indeed + attachments rights are stricter than message rights which may lead to + ACLs issues e.g. when posting on a readonly document or replying to + a notification on a private document. + :param list(tuple(str,str)) or list(tuple(str,str, dict)) attachments: list of attachment tuples in the form ``(name,content)`` or `(name,content, info)`` where content is NOT base64 encoded; @@ -2166,7 +2173,7 @@ class MailThread(models.AbstractModel): # keep cid, name list and token synced with attachement_values_list length to match ids latter attachement_extra_list.append((cid, name, token)) - new_attachments = self.env['ir.attachment'].create(attachement_values_list) + new_attachments = self.env['ir.attachment'].sudo().create(attachement_values_list) attach_cid_mapping, attach_name_mapping = {}, {} for attachment, (cid, name, token) in zip(new_attachments, attachement_extra_list): if cid: