tsm-odoo
a97abef2d2
Since [1], live chat visitors are using the mail guest system for authentication. With this change, visitors are allowed to reach the attachment upload routes (even if nothing allows it in the frontend for now). This commit restricts attachment upload for guest and portal users with the `allow_visitor_upload` field that can be toggled. At the same time, this commit enables file upload when authorized on the frontend and for cross origin live chats. [1]: odoo#129770 task-3332628 closes odoo/odoo#137574 Signed-off-by: Sébastien Theys (seb) <seb@odoo.com>
23 lines
1014 B
Python
23 lines
1014 B
Python
# Part of Odoo. See LICENSE file for full copyright and licensing details.
|
|
|
|
from odoo import _
|
|
from odoo.http import route, request
|
|
from odoo.addons.mail.controllers.attachment import AttachmentController
|
|
from odoo.exceptions import AccessError
|
|
from odoo.addons.mail.models.discuss.mail_guest import add_guest_to_context
|
|
|
|
|
|
class LivechatAttachmentController(AttachmentController):
|
|
@route()
|
|
@add_guest_to_context
|
|
def mail_attachment_upload(self, ufile, thread_id, thread_model, is_pending=False, **kwargs):
|
|
thread = request.env[thread_model]._get_from_context_or_raise(int(thread_id))
|
|
if (
|
|
thread_model == "discuss.channel"
|
|
and thread.channel_type == "livechat"
|
|
and not thread.livechat_active
|
|
and not request.env.user._is_internal()
|
|
):
|
|
raise AccessError(_("You are not allowed to upload attachments on this channel."))
|
|
return super().mail_attachment_upload(ufile, thread_id, thread_model, is_pending, **kwargs)
|