Thibault Delavallée
37c100a87d
When creating a <mail.message> with attachments a manual check is done on given attachemnts to ensure user have rights to read them. Indeed otherwise user could simply give attachments from a protected document when posting on a document he can read and try to gain information about those. However sometimes user can post and create messages without having read access on the document, e.g. when being notified and answering in a multi company environment. In this commit we consider that creating a message with attachments linked to the same document does not require an additional check for attachments. The check is performed at message level (see its custom 'check_access_rule') and is considered sufficient. However attachments linked to other documents using model and res_id are still checked. This fix helps greening the 'test_post_wo_access' test recently introduced. Task-3213982 (Mail: fix 'multi-company' post support) X-original-commit: odoo/odoo@bab0549904 Part-of: odoo/odoo#114511
Odoo
Odoo is a suite of web based open source business apps.
The main Odoo Apps include an Open Source CRM, Website Builder, eCommerce, Warehouse Management, Project Management, Billing & Accounting, Point of Sale, Human Resources, Marketing, Manufacturing, ...
Odoo Apps can be used as stand-alone applications, but they also integrate seamlessly so you get a full-featured Open Source ERP when you install several Apps.
Getting started with Odoo
For a standard installation please follow the Setup instructions from the documentation.
To learn the software, we recommend the Odoo eLearning, or Scale-up, the business game. Developers can start with the developer tutorials