Sébastien Theys
005b76462a
* = bus, crm_livechat, hr, mail_bot, test_discuss_full, test_mail,
website_livechat
Now that livechat uses guest, we can write proper ACL for channel and
channel member to check if the current user/guest is a member.
This allows removing most sudo in code and to simplify search domains.
Remaining sudo in discuss folder have been reviewed and commented.
task-3394829
closes odoo/odoo#138330
Related: odoo/upgrade#5295
Signed-off-by: Sébastien Theys (seb) <seb@odoo.com>
27 lines
1.1 KiB
Python
27 lines
1.1 KiB
Python
# Part of Odoo. See LICENSE file for full copyright and licensing details.
|
|
|
|
from werkzeug.exceptions import NotFound
|
|
|
|
from odoo import _
|
|
from odoo.http import route, request
|
|
from odoo.addons.mail.controllers.attachment import AttachmentController
|
|
from odoo.exceptions import AccessError
|
|
from odoo.addons.mail.models.discuss.mail_guest import add_guest_to_context
|
|
|
|
|
|
class LivechatAttachmentController(AttachmentController):
|
|
@route()
|
|
@add_guest_to_context
|
|
def mail_attachment_upload(self, ufile, thread_id, thread_model, is_pending=False, **kwargs):
|
|
thread = request.env[thread_model].search([("id", "=", thread_id)])
|
|
if not thread:
|
|
raise NotFound()
|
|
if (
|
|
thread_model == "discuss.channel"
|
|
and thread.channel_type == "livechat"
|
|
and not thread.livechat_active
|
|
and not request.env.user._is_internal()
|
|
):
|
|
raise AccessError(_("You are not allowed to upload attachments on this channel."))
|
|
return super().mail_attachment_upload(ufile, thread_id, thread_model, is_pending, **kwargs)
|