From e755791af8133ddc02df603e28906117c2f13fca Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Thibault=20Delavall=C3=A9e?= <tde@openerp.com>
Date: Wed, 26 Aug 2015 10:59:14 +0200
Subject: [PATCH] [FIX] mail: various fixes

- mail_message: fixed internal subtypes

Indeed has_group works only for uid and does not care for any given recordset.
Probably we need a is_in_group method on res.users. Someone smart could code it.

- mail_message: update message before notify

This way in the various notify methods, the message is correclty updated with
needaction and recipients. Also cleaned some comments.

- mail_message: avoid email loops

Do not notify people having the same email as the message / email to propagate.

- mail_message: fix access right issues

When computing recipients and partners to email, use a sudo for some internal
computation to avoid access rights issues. Indeed public user may go through
this method (forum for example).
---
 addons/mail/models/mail_message.py | 38 ++++++++++++++++++------------
 1 file changed, 23 insertions(+), 15 deletions(-)

diff --git a/addons/mail/models/mail_message.py b/addons/mail/models/mail_message.py
index 3315ecb2fca..8f180609475 100644
--- a/addons/mail/models/mail_message.py
+++ b/addons/mail/models/mail_message.py
@@ -744,6 +744,11 @@ class Message(models.Model):
         """ Add the related record followers to the destination partner_ids if is not a private message.
             Call mail_notification.notify to manage the email sending
         """
+        group_user = self.env.ref('base.group_user')
+        # have a sudoed copy to manipulate partners (public can go here with 
+        # website modules like forum / blog / ...
+        self_sudo = self.sudo()
+
         # TDE CHECK: add partners / channels as arguments to be able to notify a message with / without computation ??
         self.ensure_one()  # tde: not sure, just for testing, will see
 
@@ -754,17 +759,20 @@ class Message(models.Model):
                 ('res_model', '=', self.model),
                 ('res_id', '=', self.res_id)
             ]).filtered(lambda fol: self.subtype_id in fol.subtype_ids)
-            # if self.subtype_id.internal:
-            #     followers.filtered(lambda fol: fol.partner_id.user_ids and fol.partner_id.user_ids[0].has_group('base.group_user'))
-            channels = self.channel_ids | followers.mapped('channel_id')
-            partners = self.partner_ids | followers.mapped('partner_id')
+            if self.subtype_id.internal:
+                followers.filtered(lambda fol: fol.partner_id.user_ids and group_user in fol.partner_id.user_ids[0].mapped('groups_id'))
+            channels = self_sudo.channel_ids | followers.mapped('channel_id')
+            partners = self_sudo.partner_ids | followers.mapped('partner_id')
         else:
-            channels = self.channel_ids
-            partners = self.partner_ids
+            channels = self_sudo.channel_ids
+            partners = self_sudo.partner_ids
 
-        # remove me from notified partners
-        if self.author_id:
-            partners = partners - self.author_id
+        # remove author from notified partners
+        if self_sudo.author_id:
+            partners = partners - self_sudo.author_id
+
+        # update message
+        self.write({'channel_ids': [(6, 0, channels.ids)], 'needaction_partner_ids': [(6, 0, partners.ids)]})
 
         # notify partners
         # TDE TODO: model-dependant ? (like customer -> always email ?)
@@ -773,15 +781,15 @@ class Message(models.Model):
             '|',
             ('id', 'in', partners.ids),
             ('channel_ids', 'in', email_channels.ids),
+            ('email', '!=', self_sudo.author_id and self_sudo.author_id.email or self.email_from),
             ('notify_email', '!=', 'none')]
-        )._notify(self, force_send=force_send, user_signature=user_signature)  # TDE: clean those parameters
+        )._notify(self, force_send=force_send, user_signature=user_signature)
         # notify partners and channels
         channels._notify(self)
 
-        # An error appear when a user receive a notification without notifying
-        # the parent message -> add a read notification for the parent
+        # Discard cache, because child / parent allow reading and therefore
+        # change access rights.
         if self.parent_id:
-            self.parent_id.invalidate_cache()  # avoid access rights issues, as notifications are used for access
+            self.parent_id.invalidate_cache()
 
-        # update message
-        return self.write({'channel_ids': [(6, 0, channels.ids)], 'needaction_partner_ids': [(6, 0, partners.ids)]})
+        return True