Romain DerieandMerlin
e104937118
* website_forum Portal users cannot insert images in the WYSIWYG, eg in a forum post. Steps to reproduce: - Install website_forum - Connect as portal - Go to the forum and create a new post - Type '/image' and try to insert an image - An Access Error is raised preventing the portal user from inserting an image History: - It was possible in version earlier than 15.0 before the new editor, as it was using a base64 inplace image upload to bypass the access rights and avoid creating an attachment. - It was broken in 15.0 with the new editor which doesn't have such a mechanism. The image upload was then disabled for those users in 15.0 with [1] to avoid that bad UX with those errors/tracebacks. - It was decided to implement a clean solution in master and see from there was will be done with 15.0 (as being able to upload an image on a forum seems quite critical). Solution here in master to be able to use the media dialog: - First issue, about opening the media dialog: It fetches attachments, which is raising some access errors. We now catch the error silently and return an empty list. - Second issue, about upload an image (and thus creating an attachment): We now create attachments with sudo to allow access to portal users, but only if he has write access on the model. [1]: https://github.com/odoo/odoo/commit/e453d4c119a69f285d9a014babe485492bbe9c40 opw-2648770 task-2811325 closes odoo/odoo#82612 Signed-off-by: Romain Derie (rde) <rde@odoo.com> Co-authored-by: Merlin (megu) <megu@odoo.com>
54 lines
2.4 KiB
Python
54 lines
2.4 KiB
Python
# -*- coding: utf-8 -*-
|
|
# Part of Odoo. See LICENSE file for full copyright and licensing details.
|
|
|
|
import json
|
|
from odoo.tests.common import HttpCase, new_test_user
|
|
|
|
|
|
class TestController(HttpCase):
|
|
|
|
@classmethod
|
|
def setUpClass(cls):
|
|
super().setUpClass()
|
|
portal_user = new_test_user(cls.env, login='portal_user', groups='base.group_portal')
|
|
cls.portal = portal_user.login
|
|
admin_user = new_test_user(cls.env, login='admin_user', groups='base.group_user,base.group_system')
|
|
cls.admin = admin_user.login
|
|
cls.headers = {"Content-Type": "application/json"}
|
|
cls.pixel = 'R0lGODlhAQABAIAAAP///wAAACwAAAAAAQABAAACAkQBADs='
|
|
|
|
def _build_payload(self, params=None):
|
|
"""
|
|
Helper to properly build jsonrpc payload
|
|
"""
|
|
return {
|
|
"jsonrpc": "2.0",
|
|
"method": "call",
|
|
"id": 0,
|
|
"params": params or {},
|
|
}
|
|
|
|
def test_01_portal_attachment(self):
|
|
self.authenticate(self.portal, self.portal)
|
|
payload = self._build_payload({"name": "pixel", "data": self.pixel, "is_image": True, "res_model": "forum.post"})
|
|
response = self.url_open('/web_editor/attachment/add_data', data=json.dumps(payload), headers=self.headers, timeout=60000)
|
|
self.assertEqual(200, response.status_code)
|
|
attachment = self.env['ir.attachment'].search([('name', '=', 'pixel')])
|
|
self.assertTrue(attachment)
|
|
|
|
def test_02_admin_attachment(self):
|
|
self.authenticate(self.admin, self.admin)
|
|
payload = self._build_payload({"name": "pixel", "data": self.pixel, "is_image": True, "res_model": "forum.post"})
|
|
response = self.url_open('/web_editor/attachment/add_data', data=json.dumps(payload), headers=self.headers)
|
|
self.assertEqual(200, response.status_code)
|
|
attachment = self.env['ir.attachment'].search([('name', '=', 'pixel')])
|
|
self.assertTrue(attachment)
|
|
|
|
attachment = self.env['ir.attachment'].create([{'name': 'test_pixel', 'public': True, 'res_id': False,
|
|
'mimetype': 'text/plain', 'res_model': 'forum.post',
|
|
'raw': self.pixel, 'website_id': 1}])
|
|
domain = [('name', '=', 'test_pixel')]
|
|
result = attachment.search_read(domain)
|
|
self.assertTrue(len(result), "No attachment fetched")
|
|
self.assertEqual(result[0]['id'], attachment.id)
|