Thibault Delavallée
2175bde607
Purpose of this commit is to clearly check input of ``message_post`` method and its main helpers in order to prevent wrong usage of message post API. Some values used to populate message fields should not be set directly when posting or logging messages. Indeed they may be part of other process (like notification process managed by ``_notify_thread``, or could be setup by custom routes like 'reaction_ids', or custom usage of 'model' and 'res_id' that could conflicts with record on which methods are called). We therefore add checks and cleanup in those methods to be sure the API is used as intended and avoid unwanted side effects. Task-2710804 (Mail: Clean MailThread Posting API) Part-of: odoo/odoo#99482
33 lines
1.3 KiB
Python
33 lines
1.3 KiB
Python
# -*- coding: utf-8 -*-
|
|
# Part of Odoo. See LICENSE file for full copyright and licensing details.
|
|
|
|
from odoo import api, models, _
|
|
|
|
|
|
class MailThread(models.AbstractModel):
|
|
_inherit = 'mail.thread'
|
|
|
|
@api.returns('mail.message', lambda value: value.id)
|
|
def message_post(self, **kwargs):
|
|
rating_id = kwargs.pop('rating_id', False)
|
|
rating_value = kwargs.pop('rating_value', False)
|
|
rating_feedback = kwargs.pop('rating_feedback', False)
|
|
message = super(MailThread, self).message_post(**kwargs)
|
|
|
|
# create rating.rating record linked to given rating_value. Using sudo as portal users may have
|
|
# rights to create messages and therefore ratings (security should be checked beforehand)
|
|
if rating_value:
|
|
self.env['rating.rating'].sudo().create({
|
|
'rating': float(rating_value) if rating_value is not None else False,
|
|
'feedback': rating_feedback,
|
|
'res_model_id': self.env['ir.model']._get_id(self._name),
|
|
'res_id': self.id,
|
|
'message_id': message.id,
|
|
'consumed': True,
|
|
'partner_id': self.env.user.partner_id.id,
|
|
})
|
|
elif rating_id:
|
|
self.env['rating.rating'].browse(rating_id).write({'message_id': message.id})
|
|
|
|
return message
|