[FIX] website_slides: allow portal users to read their own reviews with attachment

Followup of 86c80d341846894c435b1c8f61ef946b06e72ec7 : currently portal users face an access issue
if they try to read their full review with attachments. This commit fixes that
by sudo-ing access to the attachment as other access is already granted.

Task ID 2214795

X-original-commit: ad7cd4bd38fdb0d92b22bb979637bb5623621378

1 files changed, 7 insertions, 3 deletions

diff --git a/addons/website_slides/controllers/main.py b/addons/website_slides/controllers/main.py
index ba2a8440753..385d7b572b1 100644
--- a/addons/website_slides/controllers/main.py
+++ b/addons/website_slides/controllers/main.py
@@ -463,9 +463,13 @@ class WebsiteSlides(WebsiteProfile):
                 last_message_values = last_message.read(['body', 'rating_value', 'attachment_ids'])[0]
                 last_message_attachment_ids = last_message_values.pop('attachment_ids', [])
                 if last_message_attachment_ids:
-                    last_message_attachment_ids = json.dumps(request.env['ir.attachment'].browse(last_message_attachment_ids).read(
-                        ['id', 'name', 'mimetype', 'file_size', 'access_token']
-                    ))
+                    # use sudo as portal user cannot read access_token, necessary for updating attachments
+                    # through frontend chatter -> access is already granted and limited to current user message
+                    last_message_attachment_ids = json.dumps(
+                        request.env['ir.attachment'].sudo().browse(last_message_attachment_ids).read(
+                            ['id', 'name', 'mimetype', 'file_size', 'access_token']
+                        )
+                    )
             else:
                 last_message_values = {}
                 last_message_attachment_ids = []