diff options
| author | Raphael Collet <rco@odoo.com> | 2019-06-27 15:00:41 +0000 |
|---|---|---|
| committer | Raphael Collet <rco@odoo.com> | 2019-07-04 11:32:22 +0000 |
| commit | caf900e89ea292c56ed773232792a2aab19de8d5 (patch) | |
| tree | d2d4b59e10a00fe514e3a38ea0966b1fd8389a6d /addons/payment_buckaroo/controllers | |
| parent | 6230f72d2be58069dfd264623944a45c84c99ba4 (diff) | |
[FIX] *: use `auth='public'` in controllers that use `request.env`
The following trick used to work, because `sudo()` was actually making
an environment for the superuser to operate upon:
request.env[...].sudo().method(...)
It no longer works in general, since `sudo()` now makes an environment
in superuser mode but with `uid=None`! It may still work by accident
for operations that never use `env.uid`, but is broken in general.
Using `auth='public'` fixes the problem by using the public user when no
user is available.
closes odoo/odoo#34297
Signed-off-by: Olivier Dony (odo) <odo@openerp.com>
Diffstat (limited to 'addons/payment_buckaroo/controllers')
| -rw-r--r-- | addons/payment_buckaroo/controllers/main.py | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/addons/payment_buckaroo/controllers/main.py b/addons/payment_buckaroo/controllers/main.py index 7fe17c8344f..1810355cc3c 100644 --- a/addons/payment_buckaroo/controllers/main.py +++ b/addons/payment_buckaroo/controllers/main.py @@ -21,7 +21,7 @@ class BuckarooController(http.Controller): '/payment/buckaroo/cancel', '/payment/buckaroo/error', '/payment/buckaroo/reject', - ], type='http', auth='none', csrf=False) + ], type='http', auth='public', csrf=False) def buckaroo_return(self, **post): """ Buckaroo.""" _logger.info('Buckaroo: entering form_feedback with post data %s', pprint.pformat(post)) # debug |