When fetching messages from the portal controller, we might
give a domain to restrict the message selection. Typically,
the ecommerce allows users to submit messages with rating
of the product. Users are allowed to filter the messages
with a certain rating.
Passing a non-normalized domain to this controller could
give strange result, as the code was using `+=` to concat
domains; some result domain could have been correct, but
return some strange results.
This commit normalizes all domains used in the code
making a non-normalized domain (given as parameter) crashes,
instead of returning unexpected messages.
Closes#26939
Have the main company (A) with the public user
Have an invoice in company B
Make a brand new browser access the invoice with the token
Before this commit: the token link ended up asking the customer to login,
eventhough it wouldn't if the invoice were in company A
After this commit: the whole payment with access token flow works as expected.
OPW 1879999
closes#26744
In bd4f09f there was a typo in the domain portal message fetch (two `&`
instead of one), luckily this did not cause an error in 11.0
But in master expression.AND normalizes the domain, thus we got an error.
opw-1819702
closes#25131
In the frontend only plaintext is saved without any javascript fiddling
so in the controller it should be adapted to be saved.
With this change, the behavior is more similar to backend chatter which
sends html (processed by javascript) to the server.
opw-1817918
closes#23706
When a chatter is displayed and the document is accessed with a valid
access_token, the message related to the document are searched in sudo.
This bypass valid filtering we may down the line.
This change apply the filtering so note type messages are not displayed
for user who are not employees.
note: before 11.0 this logic was in 1b5c2ced. In future version it would
probably be better to have a method eg. _get_domain_based_on_user
that would be called before sudo and if not sudo.
opw-1819702
closes#23544
After removing the `sha_in` params a while ago, we get rid of
the deprecated `token_field` option.
- Make `token_field` a model attribute, so that each model can easily
define the token field that should be used, and it does not need
to be passed around all the time anymore.
- Rename `_special_access_object()` to `_has_token_access()`, much more
readable since it returns a bool
- Do not forward the `attachment_ids` keyword arg to message_post,
as it sometimes contains unrelated IDs (the helper is not meant
to post attachments anyway)
- Update callers accordingly
jem-odoo