Daily updates from Odoo
Tuesday, July 23, 2019
1 change
Enhancements to existing features
Portal users who access a shared document through a token can now download the attachments that are visible in the document chatter. Each visible attachment gets its own access token, helping users access the files they should see without exposing private or internal attachments.
Original PR description
Before this commit if a user has access to a document thanks to an access_token, he would already be able to see the chatter for the document, but he would not be able to download the attachments…
Before this commit if a user has access to a document thanks to an access_token, he would already be able to see the chatter for the document, but he would not be able to download the attachments that are shown to him on that same chatter. The goal of this commit it to let the user download those attachments. To solve this issue we could have used the access_token of the main document, but this would allow any user with the token to access all attachments of the document, including those he should potentially not be able to see such as those from internal notes. Instead we ensure a different access_token is properly set on each of the attachments that are going to be shown and we update their links accordingly. This allows for a more granular access control, and it also takes advantage of the existing /web/content route without having to adapt it. Part of task-37264 Co-authored-by: Pratima Gupta <pgu@odoo.com> Co-authored-by: Sébastien Theys <seb@odoo.com> Description of the issue/feature this PR addresses: Current behavior before PR: Desired behavior after PR is merged: -- I confirm I have signed the CLA and read the PR guidelines at www.odoo.com/submit-pr