From b26ad79a8c3f02726ed3f22f73faf49a2a272d1d Mon Sep 17 00:00:00 2001 From: Christophe Matthieu Date: Tue, 20 Feb 2018 14:07:52 +0100 Subject: [FIX] web_editor,mail: send email's attachments without write access Before this fix, when a user don't have write access on a document, he can't send an email with attachment because, the attachments is added on the document. The change improving security was introduced by the commit: https://github.com/odoo/odoo/commit/6494f511718893eec3573c60c0a62e04d386359d With this fix, for mail, the attachments is added on the 'mail.compose.message' and re-render the fields attachments displayed in the current view. This change respect the access rules like all others attachment of 'mail.compose.message' (can send an email when the user have read access on the document). The media dialog of the html widget display all documents attachments and the added attachments Allowing users to use these in the body of their message. --- addons/web_editor/controllers/main.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'addons/web_editor/controllers/main.py') diff --git a/addons/web_editor/controllers/main.py b/addons/web_editor/controllers/main.py index 502d2190d5b..91b698bf03a 100644 --- a/addons/web_editor/controllers/main.py +++ b/addons/web_editor/controllers/main.py @@ -160,7 +160,7 @@ class Web_Editor(http.Controller): 'name': name, 'type': 'url', 'url': url, - 'public': True, + 'public': res_model == 'ir.ui.view', 'res_id': res_id, 'res_model': res_model, }) @@ -187,7 +187,7 @@ class Web_Editor(http.Controller): 'name': c_file.filename, 'datas': base64.b64encode(data), 'datas_fname': c_file.filename, - 'public': True, + 'public': res_model == 'ir.ui.view', 'res_id': res_id, 'res_model': res_model, }) -- cgit v1.2.3