Commit 78ac6de52d refactored methods checking alias security on the
routing found for a given destination address. Indeed if a routing is found
linked to an alias a security check is performed according to the restriction
defined on the alias itself.
HR module adds the 'employees only' restriction. A bug has been introduced
in the mentioned commit concerning employees-based aliases. Indeed a condition
on having a recordset has been added (self.ids, changed to record.ids at
20d8025036). This condition is actually not necessary as checking the
email author is linked to an existing employee has nothing to do with the
alias being linked to a record or creating new record.
This may causes issues notably using employees-restricted aliases in
expense application. Indeed you could use aliases to create new expenses
for employees and you could have issues with this condition.
This commit is linked to task ID 1829860 and ID 35093. Closes#22960 .
You could try to check followers on a model not inheriting from mail alias
mixin. In that case current code would check followers on a void mail
alias mixin record, meaning no followers found. Instead we now
differentiate the class method from the method checking record properties.
Currently check of alias security is directly embedded in mail.thread
routing method. In this commit we move this check in the mail.alias.mixin
class itself. Doing this allows models to extend or improve the behavior
depending on how inheriting models use aliases.
New feature in mail module
==========================
Currently, an email can be sent to an alias from:
- Everyone
- Authenticated Partners
- Followers
This commit is intended to add another category: Employees
The main purpose of this new feature is to allow employees to send an email
to an 'expense' alias in order to create automatically their expenses with
their mobile phones.
Use this new mechanism in hr_expense
====================================
Currenlty, we're overriding message_new to make a security check and create
an expense if the sender is an employee or bounce otherwise, which is not the
correct way to achieve this. A better way is to use the alias mechanism now
that it has been extended to employees too.
Don't hardcode email_from
=========================
The email_from of the bounce email is hardcoded to "help@odoo.com". I am sure
they will be happy to receive all answers from any odoo instance
Review the bounce email content
===============================
content: Your expense has not been created because your email address is not set
on an employee or on a employee's user. Configure your employee's information correctly and try again.
-> this is a message for the admin, not an employee or anyone else
Now the content is generical for aliase defined for employees.
Rohan Patel