diff options
| author | Raphael Collet <rco@odoo.com> | 2019-06-27 15:00:41 +0000 |
|---|---|---|
| committer | Raphael Collet <rco@odoo.com> | 2019-07-04 11:32:22 +0000 |
| commit | caf900e89ea292c56ed773232792a2aab19de8d5 (patch) | |
| tree | d2d4b59e10a00fe514e3a38ea0966b1fd8389a6d /addons/mail/controllers | |
| parent | 6230f72d2be58069dfd264623944a45c84c99ba4 (diff) | |
[FIX] *: use `auth='public'` in controllers that use `request.env`
The following trick used to work, because `sudo()` was actually making
an environment for the superuser to operate upon:
request.env[...].sudo().method(...)
It no longer works in general, since `sudo()` now makes an environment
in superuser mode but with `uid=None`! It may still work by accident
for operations that never use `env.uid`, but is broken in general.
Using `auth='public'` fixes the problem by using the public user when no
user is available.
closes odoo/odoo#34297
Signed-off-by: Olivier Dony (odo) <odo@openerp.com>
Diffstat (limited to 'addons/mail/controllers')
| -rw-r--r-- | addons/mail/controllers/bus.py | 4 | ||||
| -rw-r--r-- | addons/mail/controllers/main.py | 2 |
2 files changed, 3 insertions, 3 deletions
diff --git a/addons/mail/controllers/bus.py b/addons/mail/controllers/bus.py index 912aae3cacd..6ad8cc88870 100644 --- a/addons/mail/controllers/bus.py +++ b/addons/mail/controllers/bus.py @@ -34,7 +34,7 @@ class MailChatController(BusController): # -------------------------- # Anonymous routes (Common Methods) # -------------------------- - @route('/mail/chat_post', type="json", auth="none", cors="*") + @route('/mail/chat_post', type="json", auth="public", cors="*") def mail_chat_post(self, uuid, message_content, **kwargs): # find the author from the user session, which can be None author_id = False # message_post accept 'False' author_id, but not 'None' @@ -46,7 +46,7 @@ class MailChatController(BusController): message = mail_channel.sudo().with_context(mail_create_nosubscribe=True).message_post(author_id=author_id, email_from=False, body=body, message_type='comment', subtype='mail.mt_comment') return message and message.id or False - @route(['/mail/chat_history'], type="json", auth="none", cors="*") + @route(['/mail/chat_history'], type="json", auth="public", cors="*") def mail_chat_history(self, uuid, last_id=False, limit=20): channel = request.env["mail.channel"].sudo().search([('uuid', '=', uuid)], limit=1) if not channel: diff --git a/addons/mail/controllers/main.py b/addons/mail/controllers/main.py index 38c4cbb3509..b540d428ba0 100644 --- a/addons/mail/controllers/main.py +++ b/addons/mail/controllers/main.py @@ -189,7 +189,7 @@ class MailController(http.Controller): subtypes_list = sorted(subtypes_list, key=lambda it: (it['parent_model'] or '', it['res_model'] or '', it['internal'], it['sequence'])) return subtypes_list - @http.route('/mail/view', type='http', auth='none') + @http.route('/mail/view', type='http', auth='public') def mail_action_view(self, model=None, res_id=None, access_token=None, **kwargs): """ Generic access point from notification emails. The heuristic to choose where to redirect the user is the following : |