From f01ce962043253a2f9e6fb7173db8a295d593a3c Mon Sep 17 00:00:00 2001 From: ryv-odoo Date: Fri, 18 Oct 2019 07:27:47 +0000 Subject: [PATCH] [FIX] website_sale_digital : fix AccessError attachment A user get a AccessError during a valid flow on the website shop due to a attachment search (with website_sale_digital installed) : - As a portal user buy a product and pay with wire tranfer (or other) - Check the your quotation with this user and we get a AccessError for the read ir.attachment model. The bug comes from the website_sale_digital module which add a search on ir.attachment for each product (allows digital product sell, eg. ebook) on the controller rendering orders. To fix this issue, add a sudo call before the search. It is legit because only the name and date is retrieved and the download (of the digital product) checks the access of this product attachment (if user already paid for it). TASK_ID : 2004031 closes odoo/odoo#39043 X-original-commit: c757e14cb791262485a949eacdcfb2029d03fa5f Signed-off-by: ryv-odoo --- addons/website_sale_digital/controllers/main.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/addons/website_sale_digital/controllers/main.py b/addons/website_sale_digital/controllers/main.py index 1184655e263..2abd4005e27 100644 --- a/addons/website_sale_digital/controllers/main.py +++ b/addons/website_sale_digital/controllers/main.py @@ -49,7 +49,7 @@ class WebsiteSaleDigital(CustomerPortal): Attachment = request.env['ir.attachment'] product_id = product.id template = product.product_tmpl_id - att = Attachment.search_read( + att = Attachment.sudo().search_read( domain=['|', '&', ('res_model', '=', product._name), ('res_id', '=', product_id), '&', ('res_model', '=', template._name), ('res_id', '=', template.id), ('product_downloadable', '=', True)], fields=['name', 'write_date'], order='write_date desc',