[MERGE] forward port branch 10.0 up to 91a1448

1 files changed, 13 insertions, 11 deletions

diff --git a/addons/mail/controllers/main.py b/addons/mail/controllers/main.py
index c579226a617..e9afcb8fab3 100644
--- a/addons/mail/controllers/main.py
+++ b/addons/mail/controllers/main.py
@@ -114,35 +114,37 @@ class MailController(http.Controller):
             return self._redirect_to_messaging()
 
         # find the access action using sudo to have the details about the access link
-        RecordModel = request.env[model]
-        record_sudo = RecordModel.sudo().browse(res_id).exists()
-        if not record_sudo:
+        RecordModel = request.env[model].sudo(uid)
+        record = RecordModel.browse(res_id).exists()
+        if not record:
             # record does not seem to exist -> redirect to login
             return self._redirect_to_messaging()
-        record_action = record_sudo.get_access_action()
+        record_action = record.get_access_action()
+
+        # only URL redirections or window actions supported currently
+        if not record_action['type'] in ('ir.actions.act_url', 'ir.actions.act_window'):
+            return self._redirect_to_messaging()
 
         # the record has an URL redirection: use it directly
         if record_action['type'] == 'ir.actions.act_url':
             return werkzeug.utils.redirect(record_action['url'])
-        # other choice: act_window (no support of anything else currently)
-        elif not record_action['type'] == 'ir.actions.act_window':
-            return self._redirect_to_messaging()
 
         # the record has a window redirection: check access rights
-        if not RecordModel.sudo(uid).check_access_rights('read', raise_exception=False):
+        if not RecordModel.check_access_rights('read', raise_exception=False):
             return self._redirect_to_messaging()
         try:
-            RecordModel.sudo(uid).browse(res_id).exists().check_access_rule('read')
+            record.check_access_rule('read')
         except AccessError:
             return self._redirect_to_messaging()
 
+        # at this point user can read the document so no issue with get_formview_id
         query = {}
         url_params = {
             'view_type': record_action['view_type'],
             'model': model,
             'id': res_id,
             'active_id': res_id,
-            'view_id': record_sudo.get_formview_id(),
+            'view_id': record.get_formview_id(),
             'action': record_action.get('id'),
         }
         url = '/web?%s#%s' % (url_encode(query), url_encode(url_params))
@@ -193,7 +195,7 @@ class MailController(http.Controller):
         return werkzeug.utils.redirect('/mail/view?%s' % url_encode({'model': model, 'res_id': res_id}))
 
     @http.route('/mail/assign', type='http', auth='user')
-    def mail_action_assign(self, model, res_id, **kwargs):
+    def mail_action_assign(self, model, res_id):
         if model not in request.env:
             return self._redirect_to_messaging()
         Model = request.env[model]