Thibault Delavallée
17bf3d9134
Currently using the ``chatter_post`` route to post a message implicitly checks for access rights on related record. It is done manually in ``message_post`` that is called by the route. It is done because record name is accessed as sudo and an explicit access has been added because of fear of information leak. However this is a bit out of scope for ``message_post`` to perform that check at that point. As the underlying record is accessed numerous times, adding an explicit check just adds queries. In portal, users may have a token and/or a hash and a partner_id, in which case they enter sudo mode if valid, and an error is raised otherwise. However when not using a token and/or a hash and a PID access check is now done directly in the controller helper. Moreover this allows to have the access error directly instead of being possibly hidden by another error, which was the case before this fix (was actually raising about missing email_from). In this commit we add an explicit check on record access before entering the post computation. That way access errors are directly raised. A fix in accounting is necessary to ensure the right error is raised. Indeed otherwise it currently raises due to non existing email_from, and should raise due to ACL instead. Tests are now more inlined with classic flows. Task-2710804 (Mail: Clean MailThread API) Part-of: odoo/odoo#99654
Odoo
Odoo is a suite of web based open source business apps.
The main Odoo Apps include an Open Source CRM, Website Builder, eCommerce, Warehouse Management, Project Management, Billing & Accounting, Point of Sale, Human Resources, Marketing, Manufacturing, ...
Odoo Apps can be used as stand-alone applications, but they also integrate seamlessly so you get a full-featured Open Source ERP when you install several Apps.
Getting started with Odoo
For a standard installation please follow the Setup instructions from the documentation.
To learn the software, we recommend the Odoo eLearning, or Scale-up, the business game. Developers can start with the developer tutorials