from `message_format` and from `_message_read_dict_postprocess`.
The reading and initial formatting is done by `_message_read_dict_postprocess`,
which has been renamed more simply to `_message_format` due to its new goal.
This makes the methods easier to follow and does not increase the query count.
It actually reduces it when the data were already in the cache, by not always
reading them again.
Part of task-2180311
PR: #43841
PURPOSE
Clean posting process and improve mail.message definition and comprehension.
SPECIFICATIONS
Website mail defines a website_published field allowing to publish / unpublish
comments on the frontend of some modules. This field has several drawbacks :
* it is used only for front-end people (portal, public) and has no real
effect in chatter / classic discussions;
* it is used only in some advanced front-end module and is not available
in portal by default;
* its naming is not really correct as it is not linked to fields coming
from the website_published mixin and its behavior is not really
the same;
* its use is a bit duplicated with internal flag coming from subtype
allowing to hide messages related to an internal subtype;
* there are overrides of standard mail.message methods just to handle
this flag;
In this commit we change that field by an is_internal flag directly on
mail.message model itself. It tells if share people (customers, share users)
are allowed to read the message. This field can be given through posting
API or set manually using widgets. It is also used in access rights custom
methods and managed like the internal flag of subtypes.
Mailgateway was already using an internal flag for internal note replies. It
is renamed to is_internal and propagated as it is now a standard field. It
also eases code understanding.
Portal is updated to allow managing the flag directly. It means customer portal
now natively allows to moderate customer comments without any need of website
modules.
Rating is updated accordingly. An is_internal field is added, replacing the
related on website published.
LINKS
Task ID 2071556
PR #38692
Spec
====
Before this commit if a user has access to a document thanks to an access_token,
he would already be able to see the chatter for the document, but he would not
be able to download the attachments that are shown to him on that same chatter.
The goal of this commit it to let the user download those attachments. This
makes sense especially since messages publicly posted in the chatter might
generate emails to the user, and the attachments will already be attached to
those emails, so this PR is not actually granting access to more information to
the user in a typical flow.
The only difference is when said user was added as a follower after the
attachments have been posted in which case he will be able to read them even
though he didn't get the original emails, but this is consistent with how he
will also be able to read the existing messages even though he didn't get them
by email.
Technical
=========
To solve this issue we could have used the access_token of the main document,
but this would allow any user with the token to access all attachments of the
document, including those he should potentially not be able to see such as those
from internal notes.
Instead we ensure a different access_token is properly set on each of the
attachments that are going to be shown and we update their links accordingly.
This allows for a more granular access control, and it also takes advantage of
the existing /web/content route without having to adapt it.
opw-2040455
Also discussed in task-37264
closes#34384closesodoo/odoo#35121
Signed-off-by: Olivier Dony (odo) <odo@openerp.com>
Co-authored-by: Pratima Gupta <pgu@odoo.com>
Co-authored-by: Sébastien Theys <seb@odoo.com>
Multi is the default api for methods, it is not necessary to explicitly
decorate methods with it, adds clutter and most people use it because
they see that the rest of the code uses it.
Done with `find . -type f -name '*.py' | xargs sed -i '/@api.multi/d'`
The field website_published is not ensured when module portal
is installed because the module portal doesn't depend on module
website_mail.
PS:The module website_mail depends on the module portal because
website_mail depends on website and website depends on portal.
opw:1997478
closesodoo/odoo#33452
Signed-off-by: Simon Goffin (sig) <sig@openerp.com>
Sébastien Theys