Pratima GuptaandSébastien Theys
cc32b7d1b3
Spec ==== Before this commit if a user has access to a document thanks to an access_token, he would already be able to see the chatter for the document, but he would not be able to download the attachments that are shown to him on that same chatter. The goal of this commit it to let the user download those attachments. This makes sense especially since messages publicly posted in the chatter might generate emails to the user, and the attachments will already be attached to those emails, so this PR is not actually granting access to more information to the user in a typical flow. The only difference is when said user was added as a follower after the attachments have been posted in which case he will be able to read them even though he didn't get the original emails, but this is consistent with how he will also be able to read the existing messages even though he didn't get them by email. Technical ========= To solve this issue we could have used the access_token of the main document, but this would allow any user with the token to access all attachments of the document, including those he should potentially not be able to see such as those from internal notes. Instead we ensure a different access_token is properly set on each of the attachments that are going to be shown and we update their links accordingly. This allows for a more granular access control, and it also takes advantage of the existing /web/content route without having to adapt it. opw-2040455 Also discussed in task-37264 closes #34384 closes odoo/odoo#35121 Signed-off-by: Olivier Dony (odo) <odo@openerp.com> Co-authored-by: Pratima Gupta <pgu@odoo.com> Co-authored-by: Sébastien Theys <seb@odoo.com>
Odoo
Odoo is a suite of web based open source business apps.
The main Odoo Apps include an Open Source CRM, Website Builder, eCommerce, Warehouse Management, Project Management, Billing & Accounting, Point of Sale, Human Resources, Marketing, Manufacturing, Purchase Management, ...
Odoo Apps can be used as stand-alone applications, but they also integrate seamlessly so you get a full-featured Open Source ERP when you install several Apps.
Getting started with Odoo
For a standard installation please follow the Setup instructions from the documentation.
Then follow the developer tutorials