[REF] rating, various: improve rating.rating ACLs

PURPOSE

Rating model should be available only for internal users. External users
access them only through dedicated routes or controllers using sudo and/or
granting access through tokens. Therefore simplifying ACLs should be feasible.

SPECIFICATIONS

Remove access to rating.rating for public and portal users. Only employees
can access it, with full access given to system admins.

Update various functional flows to use sudo() and check that access is
verified before using sudo.

Impacted modules

  * rating / mail: add groups on some rating related fields as only
    internal users should access them now;
  * rating / mail: set some statistics fields using compute_sudo as their
    value should be accessible for external people even without access to
    the underlying rating.rating records;
  * project: makes some use of rating and has to be updated, notably for
    the public rating page;
  * website_{livechat, rating, slides}: add sudo in public routes as access
    is already granted;
  * website_slides: set statistics field using compute_sudo as their
    value should be accessible for external people;

TASK ID 2053096
PR #36592

Signed-off-by: Thibault Delavallee (tde) <tde@openerp.com>

1 files changed, 1 insertions, 1 deletions

diff --git a/addons/website_slides/controllers/mail.py b/addons/website_slides/controllers/mail.py
index 0766536d538..1940189a4d0 100644
--- a/addons/website_slides/controllers/mail.py
+++ b/addons/website_slides/controllers/mail.py
@@ -65,7 +65,7 @@ class SlidesPortalChatter(PortalChatter):
         # update rating
         if post.get('rating_value'):
             domain = [('res_model', '=', res_model), ('res_id', '=', res_id), ('website_published', '=', True), ('message_id', '=', message.id)]
-            rating = request.env['rating.rating'].search(domain, order='write_date DESC', limit=1)
+            rating = request.env['rating.rating'].sudo().search(domain, order='write_date DESC', limit=1)
             rating.write({
                 'rating': float(post['rating_value'])
             })