diff options
| author | ryv-odoo <ryv@odoo.com> | 2019-10-10 08:04:29 +0000 |
|---|---|---|
| committer | Thibault Delavallée <tde@odoo.com> | 2019-11-06 10:00:04 +0000 |
| commit | 90fa3e3c60e9b96e8d9ba071ae655a576d949a96 (patch) | |
| tree | 06992348dd9cd1d41c0b9ea19fb0fdab4da27038 /addons/website/static/src/xml/website.contentMenu.xml | |
| parent | 4d71fe100d9795cd68feea85fb4e5595b9e06bb7 (diff) | |
[REF] base: simplify check method attachments now always requiring employee rights
Since commit 62c9dedafda0cbdc618641eaa80c49535ab0b5f6 attachments almost always require employee
user access, unless some specific flow grants super user rights. Moreover
other flows like portal checks user rights before going into attachments
management with superuser rights.
In this commit we simplify code by directly checking current user belongs
to internal employee group (or is a superuser / admin).
We consider tt is the role of controller/model using attachments to check
and grants access to attachments.
Some history of attachments management improvement (not complete, just
an overview of discussed points)
* 3620cb68a0190031d3e1a963d8554834ab7f192b: improve attachment management in portal;
* de7c119e666d108564b3889d1c08e5bf2e4da082: improve message_post and its attachments management;
* 62c9dedafda0cbdc618641eaa80c49535ab0b5f6: clean ACLs;
Task ID 2004031
PR #38358
closes odoo/odoo#39869
Signed-off-by: Xavier Morel (xmo) <xmo@odoo.com>
Diffstat (limited to 'addons/website/static/src/xml/website.contentMenu.xml')
0 files changed, 0 insertions, 0 deletions
