[FIX] mass_mailing: improve opened traces tracking

Purpose of this commit is to improve tracking of opened traces. Notably
a token is added to ensure we do not mess with traces and have unique
tracking URLs.

MIGRATION REMARK

Emails sent before the migration will not be marked as opened anymore after
migration. We recommend to avoid sending statistically important mass mailings
about one week before migrating database. Indeed statistics show that most of
open emails happen within the first week after being sent.

Task 2223146

closes odoo/odoo#49139

Signed-off-by: Thibault Delavallee (tde) <tde@openerp.com>

1 files changed, 6 insertions, 2 deletions

diff --git a/addons/mass_mailing/controllers/main.py b/addons/mass_mailing/controllers/main.py
index 02ffe4609c3..b5ef9b9faca 100644
--- a/addons/mass_mailing/controllers/main.py
+++ b/addons/mass_mailing/controllers/main.py
@@ -7,6 +7,7 @@ import werkzeug
 from odoo import _, exceptions, http, tools
 from odoo.http import request
 from odoo.tools import consteq
+from werkzeug.exceptions import BadRequest
 
 
 class MassMailController(http.Controller):
@@ -91,9 +92,12 @@ class MassMailController(http.Controller):
             return True
         return 'error'
 
-    @http.route('/mail/track/<int:mail_id>/blank.gif', type='http', auth='public')
-    def track_mail_open(self, mail_id, **post):
+    @http.route('/mail/track/<int:mail_id>/<string:token>/blank.gif', type='http', auth='public')
+    def track_mail_open(self, mail_id, token, **post):
         """ Email tracking. """
+        if not consteq(token, tools.hmac(request.env(su=True), 'mass_mailing-mail_mail-open', mail_id)):
+            raise BadRequest()
+
         request.env['mailing.trace'].sudo().set_opened(mail_mail_ids=[mail_id])
         response = werkzeug.wrappers.Response()
         response.mimetype = 'image/gif'