The following trick used to work, because `sudo()` was actually making
an environment for the superuser to operate upon:
request.env[...].sudo().method(...)
It no longer works in general, since `sudo()` now makes an environment
in superuser mode but with `uid=None`! It may still work by accident
for operations that never use `env.uid`, but is broken in general.
Using `auth='public'` fixes the problem by using the public user when no
user is available.
closesodoo/odoo#34297
Signed-off-by: Olivier Dony (odo) <odo@openerp.com>
In this commit we rewrite a bit add_click in order to remove the inlined sudo
and ease inheritance and parameter management inside the method.
Access through controllers is sudo-ed as the main API method is now done
with current user access rights.
This commit is linked to task ID 1904277 and PR #28242.
Link tracker models are rather technical and should not be accessed as it is
by external people. Let us delegate control to controllers and lessen a bit
model accessibility.
Currently everyone can use add_click method and generate statistics. Now
statistics will be generated only through dedicated routes. It will make
statistics more reliable and ensure technical data remain private.
Next commit will update code from controllers and main methods in order to be
have a more readable click API and avoid link between non dependent modules.
This commit is linked to task ID 1904277 and PR #28242.
The `geoip` is not always defined in the session,
and therefore one needs to check it's defined before
attempting to use it.
The same is done at different places in the code,
through the different modules.
opw-687783
Raphael Collet