[FIX] mail: `message_post` requires record write access

By default, users are supposed to be able to write messages
in threads only if they have the write access on the record.

This behavior is the behavior defined in Odoo 8.0.

This behavior can be changed by defining
`_mail_post_access` on the model,
to allow the creation of new messages
if the user has only the read access, for instance.

This is the case on `project.issue`, for instance.

Since 9.0, @ revision 88b8cd058713bfad2942f7e7434c34b6c1a6e7da,
this behavior was broken: Any users having the read
access on the record was allowed to write messages in the thread,
while this should not be the case, except if
`_mail_post_access = 'read'`
has been defined on the model.

This is because the SQL query which is performed in order
to know the thread messages the user has been notified of
was expected to return only the ids of the notified message,
while it actually always returned all the message ids of the thread,
because of the LEFT JOINS, e.g.

```
LEFT JOIN "mail_message_res_partner_rel" partner_rel
ON partner_rel.mail_message_id = m.id AND partner_rel.res_partner_id = (%%s)
```

Instead of just checking the ids of the messages returned by this
query, it must check that one of the two columns
`partner_rel.res_partner_id` or `channel_partner.partner_id`
is filled, meaning the partner has been notified of the message or
is a member of the channel the message has been posted to.

opw-668589

0 files changed, 0 insertions, 0 deletions