[FIX] mail: check access rights on models when fetching messages

- When fetching messages (e.g. opening discuss), we do not check if the
  model associated to a message is accessible for the current user.
  This could result to access rights error messages when trying to read the
  main attachment of the associated record.

  To avoid to triggers this errors, we first check if the current user
  has read access to the specific model, if so we try to read the
  record's main attachment.

closes odoo/odoo#29025

1 files changed, 2 insertions, 1 deletions

diff --git a/addons/mail/models/mail_message.py b/addons/mail/models/mail_message.py
index 1a361177cd5..c2cad44ef97 100644
--- a/addons/mail/models/mail_message.py
+++ b/addons/mail/models/mail_message.py
@@ -390,7 +390,8 @@ class Message(models.Model):
             for notification in message.notification_ids.filtered(filter_notification):
                 customer_email_data.append((partner_tree[notification.res_partner_id.id][0], partner_tree[notification.res_partner_id.id][1], notification.email_status))
 
-            main_attachment = message.model and message.res_id and self.env[message.model].search([('id', '=',message.res_id)]) and getattr(self.env[message.model].browse(message.res_id), 'message_main_attachment_id')
+            has_access_to_model = message.model and self.env[message.model].check_access_rights('read', raise_exception=False)
+            main_attachment = has_access_to_model and message.res_id and self.env[message.model].search([('id', '=',message.res_id)]) and getattr(self.env[message.model].browse(message.res_id), 'message_main_attachment_id')
             attachment_ids = []
             for attachment in message.attachment_ids:
                 if attachment.id in attachments_tree: