diff options
| author | Olivier Dony <odo@odoo.com> | 2020-11-17 14:04:08 +0000 |
|---|---|---|
| committer | Olivier Dony <odo@odoo.com> | 2020-11-17 14:16:06 +0000 |
| commit | ddf4c705ae0b83761495cd6a00d34463fa252043 (patch) | |
| tree | 55d29bcf9dc12918707bbbdb967a0b130ebec489 /addons/website/controllers/main.py | |
| parent | e369f15a9194b530c14ad1c796e4f10b80338260 (diff) | |
[FIX] website: adapt /website/action to v14 perms
As of v14 and #53335 (6c97a6d), access to `ir.actions*` models has been
restricted to admins, except in specific context such as via the
`/web/action/load` route.
This commit updates the `/website/action/` route to follow that logic,
and allow custom server actions to be exposed as "custom controllers".
The principle is that the action is located in a sudo environment, but
executed using the request environment. Access will only be permitted if
the model of the action is writable for the current user, or if any
action "groups" are set and the user belongs to one of them
(cfr f0d37c384b299e5f35cddda02d3f56c6ad37a9a7 for that part).
closes odoo/odoo#61863
Signed-off-by: Toufik Benjaa (tbe) <tbe@odoo.com>
Diffstat (limited to 'addons/website/controllers/main.py')
| -rw-r--r-- | addons/website/controllers/main.py | 12 |
1 files changed, 6 insertions, 6 deletions
diff --git a/addons/website/controllers/main.py b/addons/website/controllers/main.py index c94075e946b..374438b32c0 100644 --- a/addons/website/controllers/main.py +++ b/addons/website/controllers/main.py @@ -523,22 +523,22 @@ class Website(Home): # find the action_id: either an xml_id, the path, or an ID if isinstance(path_or_xml_id_or_id, str) and '.' in path_or_xml_id_or_id: - action = request.env.ref(path_or_xml_id_or_id, raise_if_not_found=False) + action = request.env.ref(path_or_xml_id_or_id, raise_if_not_found=False).sudo() if not action: - action = ServerActions.search([('website_path', '=', path_or_xml_id_or_id), ('website_published', '=', True)], limit=1) + action = ServerActions.sudo().search( + [('website_path', '=', path_or_xml_id_or_id), ('website_published', '=', True)], limit=1) if not action: try: action_id = int(path_or_xml_id_or_id) + action = ServerActions.sudo().browse(action_id).exists() except ValueError: pass - # check it effectively exists - if action_id: - action = ServerActions.browse(action_id).exists() # run it, return only if we got a Response object if action: if action.state == 'code' and action.website_published: - action_res = action.run() + # use main session env for execution + action_res = ServerActions.browse(action.id).run() if isinstance(action_res, werkzeug.wrappers.Response): return action_res |