Daily updates from Odoo
Monday, December 2, 2019
1 change · master
Security fixes and vulnerability patches
Odoo now treats outgoing email records as an internal system component rather than something regular users create directly. Email-related flows were updated to keep automated messages working while improving consistency of sender details and reducing inappropriate access.
Original PR description
From now on mail.mail is considered as a technical model. Indeed people should not really manually craft mails by hand. Instead various functional flows should either send mails, either craft mails…
From now on mail.mail is considered as a technical model. Indeed people should
not really manually craft mails by hand. Instead various functional flows
should either send mails, either craft mails based on some user input.
We therefore make mail restricted to admin users. Flows creating mail.mail
are updated to use sudo, and ensure it was done in a context that makes
sense to delegate this power to the user.
Some cleaning is performed prior to that change of ACLs, done in separate
commits. This cleaning includes
* ease the use of mail.thread tool method _message_compute_author by
cleaning its api (return tuple instead of dict);
* give a way to access to company email and catchall with formatting.
Those will be used in various automated emails. Indeed currently several
templates use either ``company_id.partner_id.email``, ``company_id.email``
or even don't provide fallback values;
* improve mail creation calls, notably author and email from default
computation. Purpose is to correctly compute author_id and email_from
in mail_message and mail_mail as they depends from each other. Moreover
it is a good idea in various flows to specify email and author when giving
creation values to avoid default computation that is not always guaranteed
to be accurate notably when involving super user;
* improve author / email_from synchronization in default values in mail
composer;
* clean some calls to mail.template send_mail();
Task ID 1853147
PR #32243