[FIX] website_profile: fix edit profile issue

PURPOSE

Before this commit when an administrator edit another user's profile it
was his own data that displayed for the changes.
This commit fixes this issue.

SPECIFICATION

Add a test in both controller route when displaying the edit view and
when submitting the changes that check if the edited user is the same
as the actual user.

LINKS

Task ID : 2222043
PR : #48262

closes odoo/odoo#48575

X-original-commit: 4ab4de5b57a17002d8b14584c7d39a29e8bca357
Signed-off-by: Thibault Delavallee (tde) <tde@openerp.com>

1 files changed, 11 insertions, 2 deletions

diff --git a/addons/website_profile/controllers/main.py b/addons/website_profile/controllers/main.py
index 3d14024d1a0..1b1502978a1 100644
--- a/addons/website_profile/controllers/main.py
+++ b/addons/website_profile/controllers/main.py
@@ -120,8 +120,13 @@ class WebsiteProfile(http.Controller):
     # ---------------------------------------------------
     @http.route('/profile/edit', type='http', auth="user", website=True)
     def view_user_profile_edition(self, **kwargs):
+        user_id = int(kwargs.get('user_id'))
         countries = request.env['res.country'].search([])
-        values = self._prepare_user_values(searches=kwargs)
+        if user_id and request.env.user.id != user_id and request.env.user._is_admin():
+            user = request.env['res.users'].browse(user_id)
+            values = self._prepare_user_values(searches=kwargs, user=user, is_public_user=False)
+        else:
+            values = self._prepare_user_values(searches=kwargs)
         values.update({
             'email_required': kwargs.get('email_required'),
             'countries': countries,
@@ -151,7 +156,11 @@ class WebsiteProfile(http.Controller):
 
     @http.route('/profile/user/save', type='http', auth="user", methods=['POST'], website=True)
     def save_edited_profile(self, **kwargs):
-        user = request.env.user
+        user_id = int(kwargs.get('user_id'))
+        if user_id and request.env.user.id != user_id and request.env.user._is_admin():
+            user = request.env['res.users'].browse(user_id)
+        else:
+            user = request.env.user
         values = self._profile_edition_preprocess_values(user, **kwargs)
         whitelisted_values = {key: values[key] for key in type(user).SELF_WRITEABLE_FIELDS if key in values}
         user.write(whitelisted_values)