diff options
| author | Raphael Collet <rco@odoo.com> | 2019-06-27 15:00:41 +0000 |
|---|---|---|
| committer | Raphael Collet <rco@odoo.com> | 2019-07-04 11:32:22 +0000 |
| commit | caf900e89ea292c56ed773232792a2aab19de8d5 (patch) | |
| tree | d2d4b59e10a00fe514e3a38ea0966b1fd8389a6d /addons/payment_transfer | |
| parent | 6230f72d2be58069dfd264623944a45c84c99ba4 (diff) | |
[FIX] *: use `auth='public'` in controllers that use `request.env`
The following trick used to work, because `sudo()` was actually making
an environment for the superuser to operate upon:
request.env[...].sudo().method(...)
It no longer works in general, since `sudo()` now makes an environment
in superuser mode but with `uid=None`! It may still work by accident
for operations that never use `env.uid`, but is broken in general.
Using `auth='public'` fixes the problem by using the public user when no
user is available.
closes odoo/odoo#34297
Signed-off-by: Olivier Dony (odo) <odo@openerp.com>
Diffstat (limited to 'addons/payment_transfer')
| -rw-r--r-- | addons/payment_transfer/controllers/main.py | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/addons/payment_transfer/controllers/main.py b/addons/payment_transfer/controllers/main.py index 29a1d20d8e1..35a34831b00 100644 --- a/addons/payment_transfer/controllers/main.py +++ b/addons/payment_transfer/controllers/main.py @@ -14,7 +14,7 @@ class OgoneController(http.Controller): @http.route([ '/payment/transfer/feedback', - ], type='http', auth='none', csrf=False) + ], type='http', auth='public', csrf=False) def transfer_form_feedback(self, **post): _logger.info('Beginning form_feedback with post data %s', pprint.pformat(post)) # debug request.env['payment.transaction'].sudo().form_feedback(post, 'transfer') |