Reproduction:
1. Create a survey or use an existing one
2. Share it via mail
3. Try to open a link provided in the mail
Reason: the conditions for public users in _check_validity() are not
refined enough. The link in the email has answer_token, while the
general Survey URL is a direct link to the survey. However, the
condition ”request.env.user._is_public() ” is true for both cases. This
leads to redirection to the homepage for survey links in the email.
Tested locally that sending two different recipients same survey by
email will assign two different answer tokens
Fix: add the answer_token to the condition. If there is an answer_token
part, it means this link is specific for a partner, and no user check is
needed. Because ideally, only this partner received the link. If there’s
a leakage, it’s probably his/her problem
Original commit: 3c71f66bb541fcf31f31e75b60f7825d26109bc4
First fix: cffc732e58c14541abcf06bb0d58add224396b7c
opw-2795134
closesodoo/odoo#87258
X-original-commit: 5599995d80d1cefaa7ddcb91a201756acc8cbf02
Signed-off-by: Thibault Delavallee (tde) <tde@openerp.com>
Jinjiu Liu
588578c365