Jorge Pinna Puissant
5faf3ce15e
Message with type user_notification are special "invisible" notifications that are not accessible to users normally. That's why they were excluded from the automatic message deletion in mail.thread.unlink(), to avoid permission errors. But this caused orphans leftover notifications in the database, and the fix here is to instead do the deletion of messages in sudo mode, and make sure user_notification messages are deleted as well. Doing this is not a security risk because the deletion of the record itself (the super call) is still done without sudo, and if it fails, the whole transaction will be rolled back. And it is part of the expected ACLs for messages that if you can delete a record you are allowed delete its messages. The fact that user_notification messages are not accessible by normal users is for usability reasons (noise in chatter), not security reasons. opw-2234282 closes odoo/odoo#51010 X-original-commit: 094559aef4fdfebcba43a089cec4da5f4028a8f2 Signed-off-by: Jorge Pinna Puissant (jpp) <jpp@odoo.com>
Odoo
Odoo is a suite of web based open source business apps.
The main Odoo Apps include an Open Source CRM, Website Builder, eCommerce, Warehouse Management, Project Management, Billing & Accounting, Point of Sale, Human Resources, Marketing, Manufacturing, ...
Odoo Apps can be used as stand-alone applications, but they also integrate seamlessly so you get a full-featured Open Source ERP when you install several Apps.
Getting started with Odoo
For a standard installation please follow the Setup instructions from the documentation.
To learn the software, we recommend the Odoo eLearning, or Scale-up, the business game. Developers can start with the developer tutorials