[FIX] mail: prevent attachment delete from not authored message

task-2299330

closes odoo/odoo#55164

X-original-commit: c331b6761fbc1e8dd4d554109acab142ab02702d
Signed-off-by: Alexandre Kühn (aku) <aku@odoo.com>

2 files changed, 64 insertions, 21 deletions

diff --git a/addons/mail/static/src/components/message/message.xml b/addons/mail/static/src/components/message/message.xml
index 51689f70449..02a0c49e20c 100644
--- a/addons/mail/static/src/components/message/message.xml
+++ b/addons/mail/static/src/components/message/message.xml
@@ -190,7 +190,7 @@
                                 <AttachmentList
                                     class="o_Message_attachmentList"
                                     areAttachmentsDownloadable="true"
-                                    areAttachmentsEditable="true"
+                                    areAttachmentsEditable="message.author === env.messaging.currentPartner"
                                     attachmentLocalIds="imageAttachments.map(attachment => attachment.localId)"
                                     attachmentsDetailsMode="props.attachmentsDetailsMode"
                                 />
@@ -199,7 +199,7 @@
                                 <AttachmentList
                                     class="o_Message_attachmentList"
                                     areAttachmentsDownloadable="true"
-                                    areAttachmentsEditable="true"
+                                    areAttachmentsEditable="message.author === env.messaging.currentPartner"
                                     attachmentLocalIds="nonImageAttachments.map(attachment => attachment.localId)"
                                     attachmentsDetailsMode="props.attachmentsDetailsMode"
                                 />
diff --git a/addons/mail/static/src/components/message/message_tests.js b/addons/mail/static/src/components/message/message_tests.js
index 63ee06a4a78..ce01dab0c7c 100644
--- a/addons/mail/static/src/components/message/message_tests.js
+++ b/addons/mail/static/src/components/message/message_tests.js
@@ -125,25 +125,6 @@ QUnit.test('basic rendering', async function (assert) {
     );
 });
 
-QUnit.test('delete attachment linked to message', async function (assert) {
-    assert.expect(1);
-
-    await this.start();
-    const message = this.env.models['mail.message'].create({
-        attachments: [['insert-and-replace', {
-            filename: "BLAH.jpg",
-            id: 10,
-            name: "BLAH",
-        }]],
-        author: [['insert', { id: 7, display_name: "Demo User" }]],
-        body: "<p>Test</p>",
-        id: 100,
-    });
-    await this.createMessageComponent(message);
-    await afterNextRender(() => document.querySelector('.o_Attachment_asideItemUnlink').click());
-    assert.notOk(this.env.models['mail.attachment'].find(attachment => attachment.id === 10));
-});
-
 QUnit.test('moderation: moderated channel with pending moderation message (author)', async function (assert) {
     assert.expect(1);
 
@@ -701,6 +682,68 @@ QUnit.test('only show messaging seen indicator if authored by me, after last see
     );
 });
 
+QUnit.test('allow attachment delete on authored message', async function (assert) {
+    assert.expect(3);
+
+    await this.start();
+    const message = this.env.models['mail.message'].create({
+        attachments: [['insert-and-replace', {
+            filename: "BLAH.jpg",
+            id: 10,
+            name: "BLAH",
+        }]],
+        author: [['insert', { id: this.env.session.partner_id, display_name: "Me" }]],
+        body: "<p>Test</p>",
+        id: 100,
+    });
+    await this.createMessageComponent(message);
+
+    assert.containsOnce(
+        document.body,
+        '.o_Attachment',
+        "should have an attachment",
+    );
+    assert.containsOnce(
+        document.body,
+        '.o_Attachment_asideItemUnlink',
+        "should have delete attachment button"
+    );
+
+    await afterNextRender(() => document.querySelector('.o_Attachment_asideItemUnlink').click());
+    assert.containsNone(
+        document.body,
+        '.o_Attachment',
+        "should no longer have an attachment",
+    );
+});
+QUnit.test('prevent attachment delete on non-authored message', async function (assert) {
+    assert.expect(2);
+
+    await this.start();
+    const message = this.env.models['mail.message'].create({
+        attachments: [['insert-and-replace', {
+            filename: "BLAH.jpg",
+            id: 10,
+            name: "BLAH",
+        }]],
+        author: [['insert', { id: 11, display_name: "Guy" }]],
+        body: "<p>Test</p>",
+        id: 100,
+    });
+    await this.createMessageComponent(message);
+
+    assert.containsOnce(
+        document.body,
+        '.o_Attachment',
+        "should have an attachment",
+    );
+    assert.containsNone(
+        document.body,
+        '.o_Attachment_asideItemUnlink',
+        "delete attachment button should not be printed"
+    );
+});
+
 });
 });
 });