diff options
| -rw-r--r-- | addons/mail/i18n/mail.pot | 12 | ||||
| -rw-r--r-- | addons/mail/models/mail_message.py | 16 | ||||
| -rw-r--r-- | addons/website_mail_channel/controllers/main.py | 6 |
3 files changed, 32 insertions, 2 deletions
diff --git a/addons/mail/i18n/mail.pot b/addons/mail/i18n/mail.pot index e2e0fd5885a..c05253173d8 100644 --- a/addons/mail/i18n/mail.pot +++ b/addons/mail/i18n/mail.pot @@ -4331,6 +4331,18 @@ msgid "Online" msgstr "" #. module: mail +#: code:addons/mail/models/mail_message.py:0 +#, python-format +msgid "Only administrators are allowed to export mail message" +msgstr "" + +#. module: mail +#: code:addons/mail/models/mail_message.py:0 +#, python-format +msgid "Only administrators are allowed to use grouped read on message model" +msgstr "" + +#. module: mail #: code:addons/mail/models/mail_channel.py:0 #, python-format msgid "" diff --git a/addons/mail/models/mail_message.py b/addons/mail/models/mail_message.py index de90a92d7d9..dd21275d779 100644 --- a/addons/mail/models/mail_message.py +++ b/addons/mail/models/mail_message.py @@ -691,6 +691,22 @@ class Message(models.Model): elem._invalidate_documents() return super(Message, self).unlink() + @api.model + def _read_group_raw(self, domain, fields, groupby, offset=0, limit=None, orderby=False, lazy=True): + if not self.env.is_admin(): + raise AccessError(_("Only administrators are allowed to use grouped read on message model")) + + return super(Message, self)._read_group_raw( + domain=domain, fields=fields, groupby=groupby, offset=offset, + limit=limit, orderby=orderby, lazy=lazy, + ) + + def export_data(self, fields_to_export): + if not self.env.is_admin(): + raise AccessError(_("Only administrators are allowed to export mail message")) + + return super(Message, self).export_data(fields_to_export) + # ------------------------------------------------------ # DISCUSS API # ------------------------------------------------------ diff --git a/addons/website_mail_channel/controllers/main.py b/addons/website_mail_channel/controllers/main.py index 37dd899b3fc..bed34aa2b14 100644 --- a/addons/website_mail_channel/controllers/main.py +++ b/addons/website_mail_channel/controllers/main.py @@ -17,7 +17,8 @@ class MailGroup(http.Controller): def _get_archives(self, group_id): MailMessage = request.env['mail.message'] - groups = MailMessage._read_group_raw( + # use sudo to avoid side-effects due to custom ACLs + groups = MailMessage.sudo()._read_group_raw( [('model', '=', 'mail.channel'), ('res_id', '=', group_id), ('message_type', '!=', 'notification')], ['subject', 'date'], groupby=["date"], orderby="date desc") @@ -44,7 +45,8 @@ class MailGroup(http.Controller): # compute statistics month_date = datetime.today() - relativedelta.relativedelta(months=1) - messages = request.env['mail.message'].read_group([ + # use sudo to avoid side-effects due to custom ACLs + messages = request.env['mail.message'].sudo().read_group([ ('model', '=', 'mail.channel'), ('date', '>=', fields.Datetime.to_string(month_date)), ('message_type', '!=', 'notification'), |