Julien Castiaux
eaff61793b
As the public user, browse the website where you usually should see some profile pictures (e.g. inside the forum). All the images are wrongly replaced by the grey avatar placeholder. When using `ir.binary._find_record` it was checking the access rights and raising `AccessError` early even if the record was `website_published`. closes odoo/odoo#113526 X-original-commit: 0611fb437b699588317919e72ccfa1c41f1245bc Signed-off-by: Julien Castiaux (juc) <juc@odoo.com>
32 lines
1.1 KiB
Python
32 lines
1.1 KiB
Python
from odoo import models
|
|
|
|
|
|
class IrBinary(models.AbstractModel):
|
|
_inherit = 'ir.binary'
|
|
|
|
def _find_record(
|
|
self, xmlid=None, res_model='ir.attachment', res_id=None,
|
|
access_token=None,
|
|
):
|
|
record = None
|
|
if xmlid:
|
|
website = self.env['website'].get_current_website()
|
|
if website.theme_id:
|
|
domain = [('key', '=', xmlid), ('website_id', '=', website.id)]
|
|
Attachment = self.env['ir.attachment']
|
|
if self.env.user.share:
|
|
domain.append(('public', '=', True))
|
|
Attachment = Attachment.sudo()
|
|
record = Attachment.search(domain, limit=1)
|
|
|
|
if not record:
|
|
record = super()._find_record(xmlid, res_model, res_id, access_token)
|
|
|
|
return record
|
|
|
|
def _find_record_check_access(self, record, access_token):
|
|
if 'website_published' in record._fields and record.sudo().website_published:
|
|
return record.sudo()
|
|
|
|
return super()._find_record_check_access(record, access_token)
|