diff options
| author | Nicolas Lempereur <nle@odoo.com> | 2019-12-13 16:51:43 +0000 |
|---|---|---|
| committer | Nicolas Lempereur <nle@odoo.com> | 2019-12-17 17:27:26 +0000 |
| commit | 525e3626bee3ebf7ff182a70cf88c17acbb2d569 (patch) | |
| tree | b47984ee3dab70d65ed678ef799c220f36af3213 /addons/project/controllers | |
| parent | 073839c6ce50feadf917cac073a6096f72c174ae (diff) | |
[FIX] project: access to portal task give access to attachment
If a visitor has access to a task through access_token, he should have
access to the task attachments. He already see the list of attachment
and their name, but since the task access_token is not propagated to the
attachment he doesn't have the rights to see them.
In this PR, we generate the attachments access_token and provide them to
the user that is viewing a task with an access_token.
opw-2125252
closes #41881
closes odoo/odoo#42121
X-original-commit: e7984c4968cde2019edca6c767d2acce2f7fe3f4
Signed-off-by: Nicolas Lempereur (nle) <nle@odoo.com>
Diffstat (limited to 'addons/project/controllers')
| -rw-r--r-- | addons/project/controllers/portal.py | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/addons/project/controllers/portal.py b/addons/project/controllers/portal.py index 200e151cc80..a8d2cc90514 100644 --- a/addons/project/controllers/portal.py +++ b/addons/project/controllers/portal.py @@ -230,5 +230,8 @@ class CustomerPortal(CustomerPortal): except (AccessError, MissingError): return request.redirect('/my') + # ensure attachment are accessible with access token inside template + for attachment in task_sudo.attachment_ids: + attachment.generate_access_token() values = self._task_get_page_view_values(task_sudo, access_token, **kw) return request.render("project.portal_my_task", values) |