From faf63c2c6009448488e95591eae3a88593122ab1 Mon Sep 17 00:00:00 2001 From: Mohammed Shekha Date: Fri, 26 Apr 2019 09:16:16 +0000 Subject: [PATCH] [FIX] website_sale_delivery: fix public user access error on carrier MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit When public user is on payment page '/shop/carrier_rate_shipment' controller is called to get delivery carrier rate. But public user has no access right on `delivery.carrier` closes odoo/odoo#32977 Signed-off-by: Jérémy Kersten (jke) --- addons/website_sale_delivery/controllers/main.py | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/addons/website_sale_delivery/controllers/main.py b/addons/website_sale_delivery/controllers/main.py index 07868364912..73c89e4943f 100644 --- a/addons/website_sale_delivery/controllers/main.py +++ b/addons/website_sale_delivery/controllers/main.py @@ -31,10 +31,12 @@ class WebsiteSaleDelivery(WebsiteSale): @http.route(['/shop/carrier_rate_shipment'], type='json', auth='public', methods=['POST'], website=True) def cart_carrier_rate_shipment(self, carrier_id, **kw): - Monetary = request.env['ir.qweb.field.monetary'] order = request.website.sale_get_order(force_create=True) + assert int(carrier_id) in order._get_delivery_methods().ids, "unallowed carrier" + Monetary = request.env['ir.qweb.field.monetary'] + res = {'carrier_id': carrier_id} - carrier = request.env['delivery.carrier'].browse(int(carrier_id)) + carrier = request.env['delivery.carrier'].sudo().browse(int(carrier_id)) rate = carrier.rate_shipment(order) if rate.get('success'): res['status'] = True