[FIX] mail: fix issue when posting a message on a document whose first message / parent is not readable

How to reproduce
================

Have a portal user commenting a task on the customer portal. He may experience
a crash if previous message / first message is not available, for example
if it is internal or not published.

This is due to reference computation used in outgoing emails as it is based
on parent messageID. Accessing it crashes although it should not as it is
used only for technical purpose.

Fix
===

In this comme we fix that issue by browsing the reference message as sudo
to access its messageID. A test is added to avoid regressions.

Task ID 2061760
PR #36845

closes odoo/odoo#44765

X-original-commit: e94349ed65e05a40af6e690e366de81fc5aa6725
Signed-off-by: Nicolas Martinelli (nim) <nim@odoo.com>
Co-authored-by: jpr-odoo <jpr@openerp.com>

2 files changed, 43 insertions, 1 deletions

diff --git a/addons/mail/models/mail_thread.py b/addons/mail/models/mail_thread.py
index 82309efe62d..b36a866ca5f 100644
--- a/addons/mail/models/mail_thread.py
+++ b/addons/mail/models/mail_thread.py
@@ -2287,7 +2287,8 @@ class MailThread(models.AbstractModel):
             'mail_message_id': message.id,
             'mail_server_id': message.mail_server_id.id, # 2 query, check acces + read, may be useless, Falsy, when will it be used?
             'auto_delete': mail_auto_delete,
-            'references': message.parent_id.message_id if message.parent_id else False,
+            # due to ir.rule, user have no right to access parent message if message is not published
+            'references': message.parent_id.sudo().message_id if message.parent_id else False,
             'subject': mail_subject,
         }
         headers = self._notify_email_headers()
diff --git a/addons/test_mail/tests/test_mail_message.py b/addons/test_mail/tests/test_mail_message.py
index 2ff5c6f7d5f..1487597f56a 100644
--- a/addons/test_mail/tests/test_mail_message.py
+++ b/addons/test_mail/tests/test_mail_message.py
@@ -2,9 +2,11 @@
 # Part of Odoo. See LICENSE file for full copyright and licensing details.
 
 import base64
+from unittest.mock import patch
 
 from odoo.addons.mail.tests.common import mail_new_test_user
 from odoo.addons.test_mail.tests.common import TestMailCommon
+from odoo.addons.test_mail.models.test_mail_models import MailTestSimple
 from odoo.exceptions import AccessError, except_orm
 from odoo.tools import mute_logger, formataddr
 from odoo.tests import tagged
@@ -322,6 +324,45 @@ class TestMessageAccess(TestMailCommon):
         self.message.write({'partner_ids': [(4, self.user_employee.partner_id.id)]})
         self.env['mail.message'].with_user(self.user_employee).create({'model': 'mail.channel', 'res_id': self.group_private.id, 'body': 'Test', 'parent_id': self.message.id})
 
+    def test_mail_message_access_create_wo_parent_access(self):
+        """ Purpose is to test posting a message on a record whose first message / parent
+        is not accessible by current user. """
+        test_record = self.env['mail.test.simple'].with_context(self._test_context).create({'name': 'Test', 'email_from': 'ignasse@example.com'})
+        partner_1 = self.env['res.partner'].create({
+            'name': 'Jitendra Prajapati (jpr-odoo)',
+            'email': 'jpr@odoo.com',
+        })
+        test_record.message_subscribe((partner_1 | self.user_admin.partner_id).ids)
+
+        message = test_record.message_post(
+            body='<p>This is First Message</p>', subject='Subject',
+            message_type='comment', subtype_xmlid='mail.mt_note')
+        # portal user have no rights to read the message
+        with self.assertRaises(except_orm):
+            message.with_user(self.user_portal).read(['subject, body'])
+
+        with patch.object(MailTestSimple, 'check_access_rights', return_value=True):
+            with self.assertRaises(except_orm):
+                message.with_user(self.user_portal).read(['subject, body'])
+
+            # parent message is accessible to references notification mail values
+            # for _notify method and portal user have no rights to send the message for this model
+            new_msg = test_record.with_user(self.user_portal).message_post(
+                body='<p>This is Second Message</p>',
+                subject='Subject',
+                parent_id=message.id,
+                message_type='comment',
+                subtype_xmlid='mail.mt_comment',
+                mail_auto_delete=False)
+
+        new_mail = self.env['mail.mail'].sudo().search([
+            ('mail_message_id', '=', new_msg.id),
+            ('references', '=', message.message_id),
+        ])
+
+        self.assertTrue(new_mail)
+        self.assertEqual(new_msg.parent_id, message)
+
     # --------------------------------------------------
     # WRITE
     # --------------------------------------------------