diff options
| author | Raphael Collet <rco@odoo.com> | 2019-06-27 15:00:41 +0000 |
|---|---|---|
| committer | Raphael Collet <rco@odoo.com> | 2019-07-04 11:32:22 +0000 |
| commit | caf900e89ea292c56ed773232792a2aab19de8d5 (patch) | |
| tree | d2d4b59e10a00fe514e3a38ea0966b1fd8389a6d /addons/link_tracker/controller | |
| parent | 6230f72d2be58069dfd264623944a45c84c99ba4 (diff) | |
[FIX] *: use `auth='public'` in controllers that use `request.env`
The following trick used to work, because `sudo()` was actually making
an environment for the superuser to operate upon:
request.env[...].sudo().method(...)
It no longer works in general, since `sudo()` now makes an environment
in superuser mode but with `uid=None`! It may still work by accident
for operations that never use `env.uid`, but is broken in general.
Using `auth='public'` fixes the problem by using the public user when no
user is available.
closes odoo/odoo#34297
Signed-off-by: Olivier Dony (odo) <odo@openerp.com>
Diffstat (limited to 'addons/link_tracker/controller')
| -rw-r--r-- | addons/link_tracker/controller/main.py | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/addons/link_tracker/controller/main.py b/addons/link_tracker/controller/main.py index d884967b5a6..b2fb720fa1e 100644 --- a/addons/link_tracker/controller/main.py +++ b/addons/link_tracker/controller/main.py @@ -9,7 +9,7 @@ from odoo.http import request class LinkTracker(http.Controller): - @http.route('/r/<string:code>', type='http', auth='none', website=True) + @http.route('/r/<string:code>', type='http', auth='public', website=True) def full_url_redirect(self, code, **post): country_code = request.session.geoip and request.session.geoip.get('country_code') or False request.env['link.tracker.click'].sudo().add_click( |