From b26ad79a8c3f02726ed3f22f73faf49a2a272d1d Mon Sep 17 00:00:00 2001
From: Christophe Matthieu <chm@odoo.com>
Date: Tue, 20 Feb 2018 14:07:52 +0100
Subject: [FIX] web_editor,mail: send email's attachments without write access

Before this fix, when a user don't have write access on a document, he
can't send an email with attachment because, the attachments is added on
the document.

The change improving security was introduced by the commit:
https://github.com/odoo/odoo/commit/6494f511718893eec3573c60c0a62e04d386359d

With this fix, for mail, the attachments is added on the
'mail.compose.message' and re-render the fields attachments displayed in
the current view. This change respect the access rules like all others
attachment of 'mail.compose.message' (can send an email when the user have
read access on the document).
The media dialog of the html widget display all documents attachments and
the added attachments Allowing users to use these in the body of their
message.
---
 addons/web_editor/static/src/js/widgets/widgets.js | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

(limited to 'addons/web_editor/static/src/js/widgets')

diff --git a/addons/web_editor/static/src/js/widgets/widgets.js b/addons/web_editor/static/src/js/widgets/widgets.js
index 371f35a99de..7854c1852c6 100644
--- a/addons/web_editor/static/src/js/widgets/widgets.js
+++ b/addons/web_editor/static/src/js/widgets/widgets.js
@@ -122,9 +122,11 @@ var ImageDialog = Widget.extend({
         this._super.apply(this, arguments);
         this.options = options || {};
         this.accept = this.options.accept || this.options.document ? "*/*" : "image/*";
-        if (this.options.res_id) {
+        if (options.domain) {
+            this.domain = typeof options.domain === 'function' ? options.domain() : options.domain;
+        } else if (options.res_id) {
             this.domain = ['|',
-                '&', ['res_model', '=', this.options.res_model], ['res_id', '=', this.options.res_id],
+                '&', ['res_model', '=', options.res_model], ['res_id', '=', options.res_id],
                 ['res_model', '=', 'ir.ui.view']];
         } else {
             this.domain = [['res_model', '=', 'ir.ui.view']];
@@ -239,6 +241,11 @@ var ImageDialog = Widget.extend({
             var style = self.style;
             if (style) { $(self.media).css(style); }
 
+            if (self.options.onUpload) {
+                // We consider that when selecting an image it is as if we upload it in the html content.
+                self.options.onUpload([img]);
+            }
+
             return self.media;
         });
     },
@@ -290,6 +297,10 @@ var ImageDialog = Widget.extend({
             for (var i=0; i<attachments.length; i++) {
                 self.file_selected(attachments[i], error);
             }
+
+            if (self.options.onUpload) {
+                self.options.onUpload(attachments);
+            }
         };
     },
     file_selection: function () {
-- 
cgit v1.2.3