diff options
| author | Thibault Delavallée <tde@odoo.com> | 2019-10-24 09:05:16 +0000 |
|---|---|---|
| committer | Thibault Delavallée <tde@odoo.com> | 2019-11-29 13:35:14 +0000 |
| commit | 69ccabb212d83bfee60c7dade36ca4b06f9f2f12 (patch) | |
| tree | 18049ec2a94b7da7d0890bae10c8d35c2d01d427 /addons/mail/wizard/mail_compose_message.py | |
| parent | 1838191eece59051805862ed6ce914bf5e5d1efb (diff) | |
[FIX] mail: restrict access to mail.mail model
From now on mail.mail is considered as a technical model. Indeed people should
not really manually craft mails by hand. Instead various functional flows
should either send mails, either craft mails based on some user input.
We therefore make mail restricted to admin users. Flows creating mail.mail
are updated to use sudo, and ensure it was done in a context that makes
sense to delegate this power to the user.
Task ID 1853147
PR #32243
Diffstat (limited to 'addons/mail/wizard/mail_compose_message.py')
| -rw-r--r-- | addons/mail/wizard/mail_compose_message.py | 11 |
1 files changed, 7 insertions, 4 deletions
diff --git a/addons/mail/wizard/mail_compose_message.py b/addons/mail/wizard/mail_compose_message.py index d3b0e6f16bf..fe4660e451b 100644 --- a/addons/mail/wizard/mail_compose_message.py +++ b/addons/mail/wizard/mail_compose_message.py @@ -208,7 +208,6 @@ class MailComposer(models.TransientModel): # Mass Mailing mass_mode = wizard.composition_mode in ('mass_mail', 'mass_post') - Mail = self.env['mail.mail'] ActiveModel = self.env[wizard.model] if wizard.model and hasattr(self.env[wizard.model], 'message_post') else self.env['mail.thread'] if wizard.composition_mode == 'mass_post': # do not send emails directly but use the queue instead @@ -233,11 +232,15 @@ class MailComposer(models.TransientModel): subtype_id = self.env['ir.model.data'].xmlid_to_res_id('mail.mt_comment') for res_ids in sliced_res_ids: - batch_mails = Mail + # mass mail mode: mail are sudo-ed, as when going through get_mail_values + # standard access rights on related records will be checked when browsing them + # to compute mail values. If people have access to the records they have rights + # to create lots of emails in sudo as it is consdiered as a technical model. + batch_mails_sudo = self.env['mail.mail'].sudo() all_mail_values = wizard.get_mail_values(res_ids) for res_id, mail_values in all_mail_values.items(): if wizard.composition_mode == 'mass_mail': - batch_mails |= Mail.create(mail_values) + batch_mails_sudo |= self.env['mail.mail'].sudo().create(mail_values) else: post_params = dict( message_type=wizard.message_type, @@ -258,7 +261,7 @@ class MailComposer(models.TransientModel): ActiveModel.browse(res_id).message_post(**post_params) if wizard.composition_mode == 'mass_mail': - batch_mails.send(auto_commit=auto_commit) + batch_mails_sudo.send(auto_commit=auto_commit) def get_mail_values(self, res_ids): """Generate the values that will be used by send_mail to create mail_messages |