Romain DerieandMerlin
e104937118
* website_forum Portal users cannot insert images in the WYSIWYG, eg in a forum post. Steps to reproduce: - Install website_forum - Connect as portal - Go to the forum and create a new post - Type '/image' and try to insert an image - An Access Error is raised preventing the portal user from inserting an image History: - It was possible in version earlier than 15.0 before the new editor, as it was using a base64 inplace image upload to bypass the access rights and avoid creating an attachment. - It was broken in 15.0 with the new editor which doesn't have such a mechanism. The image upload was then disabled for those users in 15.0 with [1] to avoid that bad UX with those errors/tracebacks. - It was decided to implement a clean solution in master and see from there was will be done with 15.0 (as being able to upload an image on a forum seems quite critical). Solution here in master to be able to use the media dialog: - First issue, about opening the media dialog: It fetches attachments, which is raising some access errors. We now catch the error silently and return an empty list. - Second issue, about upload an image (and thus creating an attachment): We now create attachments with sudo to allow access to portal users, but only if he has write access on the model. [1]: https://github.com/odoo/odoo/commit/e453d4c119a69f285d9a014babe485492bbe9c40 opw-2648770 task-2811325 closes odoo/odoo#82612 Signed-off-by: Romain Derie (rde) <rde@odoo.com> Co-authored-by: Merlin (megu) <megu@odoo.com>
16 lines
640 B
Python
16 lines
640 B
Python
# -*- coding: utf-8 -*-
|
|
# Part of Odoo. See LICENSE file for full copyright and licensing details.
|
|
from odoo import models
|
|
|
|
|
|
class ResUsers(models.Model):
|
|
_inherit = 'res.users'
|
|
|
|
def _can_manage_unsplash_settings(self):
|
|
self.ensure_one()
|
|
# Website has no dependency to web_unsplash, we cannot warranty the order of the execution
|
|
# of the overwrite done in 5ef8300.
|
|
# So to avoid to create a new module bridge, with a lot of code, we prefer to make a check
|
|
# here for website's user.
|
|
return self.has_group('base.group_erp_manager') or self.has_group('website.group_website_publisher')
|