diff options
Diffstat (limited to 'addons/web_editor/controllers/main.py')
| -rw-r--r-- | addons/web_editor/controllers/main.py | 12 |
1 files changed, 8 insertions, 4 deletions
diff --git a/addons/web_editor/controllers/main.py b/addons/web_editor/controllers/main.py index e85a678f54e..b8f3b3eb36f 100644 --- a/addons/web_editor/controllers/main.py +++ b/addons/web_editor/controllers/main.py @@ -471,10 +471,14 @@ class Web_Editor(http.Controller): values = len_args > 1 and args[1] or {} View = request.env['ir.ui.view'] - if request.env.user._is_public() \ - and xmlid in request.env['web_editor.assets']._get_public_asset_xmlids(): - View = View.sudo() - return View._render_template(xmlid, {k: values[k] for k in values if k in trusted_value_keys}) + if xmlid in request.env['web_editor.assets']._get_public_asset_xmlids(): + # For white listed assets, bypass access verification + # TODO in master this part should be removed and simply use the + # public group on the related views instead. And then let the normal + # flow handle the rendering. + return View.sudo()._render_template(xmlid, {k: values[k] for k in values if k in trusted_value_keys}) + # Otherwise use normal flow + return View.render_public_asset(xmlid, {k: values[k] for k in values if k in trusted_value_keys}) @http.route('/web_editor/modify_image/<model("ir.attachment"):attachment>', type="json", auth="user", website=True) def modify_image(self, attachment, res_model=None, res_id=None, name=None, data=None, original_id=None): |