odoo
/
odoo
2
0
Fork 0
Code Pull Requests Releases Activity

[MERGE] [FIX] mail: mail: backport of saas-2 revision 9065 and 9081 and security improvements. 

Add followers before super call in mail_thread creation.
This allows to have a value for the _set_followers call and be able to have record rules based on followers at creation.

Set the priority of message_follower_ids fields to -10 (default is 0) to be sure it will be executed before other function fields using these followers (eg: _set_stage_per_user from note.note does a browse which would trigger record rules to read the note)

Context hack to avoid checking read access at creation of the record (check create rules instead)

lp bug: https://launchpad.net/bugs/1259913 fixed

bzr revid: mat@openerp.com-20140206121438-epghqo042ync24v5
This commit is contained in:
Martin Trigaux 2014-02-06 13:14:38 +01:00
parent c234d8547d 5ebcb64c34
commit f79172c7b5
1 changed files with 20 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

29
addons/mail/mail_thread.py
View File

@ -188,10 +188,9 @@ class mail_thread(osv.AbstractModel):
new = set(command[2])
# remove partners that are no longer followers
self.message_unsubscribe(cr, uid, [id], list(old-new))
self.message_unsubscribe(cr, uid, [id], list(old-new), context=context)
# add new followers
self.message_subscribe(cr, uid, [id], list(new-old))
self.message_subscribe(cr, uid, [id], list(new-old), context=context)
def _search_followers(self, cr, uid, obj, name, args, context):
fol_obj = self.pool.get('mail.followers')
@ -238,16 +237,22 @@ class mail_thread(osv.AbstractModel):
if context is None:
context = {}
thread_id = super(mail_thread, self).create(cr, uid, values, context=context)
# subscribe uid unless asked not to
if not context.get('mail_create_nosubscribe'):
pid = self.pool['res.users'].browse(cr, SUPERUSER_ID, uid).partner_id.id
message_follower_ids = values.get('message_follower_ids') or [] # webclient can send None or False
message_follower_ids.append([4, pid])
values['message_follower_ids'] = message_follower_ids
# add operation to ignore access rule checking for subscription
context_operation = dict(context, operation='create')
else:
context_operation = context
thread_id = super(mail_thread, self).create(cr, uid, values, context=context_operation)
# automatic logging unless asked not to (mainly for various testing purpose)
if not context.get('mail_create_nolog'):
self.message_post(cr, uid, thread_id, body=_('%s created') % (self._description), context=context)
# subscribe uid unless asked not to
if not context.get('mail_create_nosubscribe'):
self.message_subscribe_users(cr, uid, [thread_id], [uid], context=context)
# auto_subscribe: take values and defaults into account
create_values = dict(values)
for key, val in context.iteritems():
@ -1188,6 +1193,9 @@ class mail_thread(osv.AbstractModel):
def message_subscribe(self, cr, uid, ids, partner_ids, subtype_ids=None, context=None):
""" Add partners to the records followers. """
if context is None:
context = {}
mail_followers_obj = self.pool.get('mail.followers')
subtype_obj = self.pool.get('mail.message.subtype')
@ -1195,7 +1203,10 @@ class mail_thread(osv.AbstractModel):
if set(partner_ids) == set([user_pid]):
try:
self.check_access_rights(cr, uid, 'read')
self.check_access_rule(cr, uid, ids, 'read')
if context.get('operation', '') == 'create':
self.check_access_rule(cr, uid, ids, 'create')
else:
self.check_access_rule(cr, uid, ids, 'read')
except (osv.except_osv, orm.except_orm):
return False
else: