diff options
| author | Toufik Benjaa <tbe@odoo.com> | 2018-04-26 14:57:40 +0200 |
|---|---|---|
| committer | Toufik Benjaa <tbe@odoo.com> | 2018-04-27 14:15:46 +0200 |
| commit | ceeba05d70a6df217d4cc431fe726ae55811f8c3 (patch) | |
| tree | bb8c54ef1f07d0e70796ded7efbd0be060b1465a | |
| parent | 50f77ba091189bd785d459c042a6cec04a125fdb (diff) | |
[FIX] website_quote: Do not raise exception when quotation viewed
- When a quotation if viewed by a customer, a note is posted in the quotation's chatter saying "Quotation viewed by customer".
This is causes issues if the quotation is accessed without the access token and by a partner that do not have the rights to write on the model "sale.order".
To address this issue we provide to the "_message_post_helper" function the sale order's access token to bypass the accesses checks.
OPW-1839183
| -rw-r--r-- | addons/website_quote/controllers/main.py | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/addons/website_quote/controllers/main.py b/addons/website_quote/controllers/main.py index 7b892f53fcc..bc5a3414414 100644 --- a/addons/website_quote/controllers/main.py +++ b/addons/website_quote/controllers/main.py @@ -50,7 +50,7 @@ class sale_quote(http.Controller): if Order and request.session.get('view_quote_%s' % Order.id) != now and request.env.user.share: request.session['view_quote_%s' % Order.id] = now body = _('Quotation viewed by customer') - _message_post_helper(res_model='sale.order', res_id=Order.id, message=body, token=token, message_type='notification', subtype="mail.mt_note", partner_ids=Order.user_id.sudo().partner_id.ids) + _message_post_helper(res_model='sale.order', res_id=Order.id, message=body, token=Order.access_token, message_type='notification', subtype="mail.mt_note", partner_ids=Order.user_id.sudo().partner_id.ids) if not Order: return request.render('website.404') |