From fee419c7ea0f04b73d0c4fcd0ab0a3e51a0c3b80 Mon Sep 17 00:00:00 2001
From: "Lucas Perais (lpe)" <lpe@odoo.com>
Date: Tue, 23 Oct 2018 14:16:48 +0000
Subject: [PATCH] [FIX] project: template render attachments sudo

Related issue odoo/odoo#27256
use case is in there

Retrieving the access token for an attachment should be done as sudo
Also, we adapt the code to the method, which appears to be "api.one" (lol)

OPW 1888873

closes odoo/odoo#28074
---
 addons/project/views/project_portal_templates.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/addons/project/views/project_portal_templates.xml b/addons/project/views/project_portal_templates.xml
index 792c1eacfd3..5e9bd638956 100644
--- a/addons/project/views/project_portal_templates.xml
+++ b/addons/project/views/project_portal_templates.xml
@@ -211,7 +211,7 @@
                                 </strong>
                                 <div class='row'>
                                     <div class="col-md-2 col-sm-3 text-center oe_attachments" t-foreach='task.attachment_ids' t-as='attachment'>
-                                        <a t-attf-href="/web/content/#{attachment.id}?download=true&amp;access_token=#{attachment.generate_access_token()}" target="_blank">
+                                        <a t-attf-href="/web/content/#{attachment.id}?download=true&amp;access_token=#{attachment.sudo().generate_access_token()[0]}" target="_blank">
                                             <div class='oe_attachment_embedded o_image o_image_small' t-att-title="attachment.name" t-att-data-mimetype="attachment.mimetype" t-attf-data-src="/web/image/#{attachment.id}/50x40"/>
                                             <div class='oe_attachment_name'><t t-esc='attachment.name' /></div>
                                         </a>