diff options
| author | Thibault Delavallée <tde@odoo.com> | 2020-04-28 08:24:16 +0000 |
|---|---|---|
| committer | Thibault Delavallée <tde@odoo.com> | 2020-05-07 09:03:24 +0000 |
| commit | d0a855985f7782a64c081b2cf4a0b0c22e488950 (patch) | |
| tree | 21be38d88ff0449fa02af43610ea87b4b8121efe | |
| parent | 7252713eac2283c90bb5f496531cd2934e490e3b (diff) | |
[FIX] website_slides: allow portal users to read their own reviews with attachment
Followup of 86c80d341846894c435b1c8f61ef946b06e72ec7 : currently portal users face an access issue
if they try to read their full review with attachments. This commit fixes that
by sudo-ing access to the attachment as other access is already granted.
Task ID 2214795
X-original-commit: ad7cd4bd38fdb0d92b22bb979637bb5623621378
| -rw-r--r-- | addons/website_slides/controllers/main.py | 10 |
1 files changed, 7 insertions, 3 deletions
diff --git a/addons/website_slides/controllers/main.py b/addons/website_slides/controllers/main.py index ba2a8440753..385d7b572b1 100644 --- a/addons/website_slides/controllers/main.py +++ b/addons/website_slides/controllers/main.py @@ -463,9 +463,13 @@ class WebsiteSlides(WebsiteProfile): last_message_values = last_message.read(['body', 'rating_value', 'attachment_ids'])[0] last_message_attachment_ids = last_message_values.pop('attachment_ids', []) if last_message_attachment_ids: - last_message_attachment_ids = json.dumps(request.env['ir.attachment'].browse(last_message_attachment_ids).read( - ['id', 'name', 'mimetype', 'file_size', 'access_token'] - )) + # use sudo as portal user cannot read access_token, necessary for updating attachments + # through frontend chatter -> access is already granted and limited to current user message + last_message_attachment_ids = json.dumps( + request.env['ir.attachment'].sudo().browse(last_message_attachment_ids).read( + ['id', 'name', 'mimetype', 'file_size', 'access_token'] + ) + ) else: last_message_values = {} last_message_attachment_ids = [] |