[tryton-commits] [tryton] [default] Enforce access rights on the email template r...

[Cédric Krier]

details:   https://code.tryton.org/tryton/commit/856dea6dca76
branch:    default
user:      Cédric Krier <c...@b2ck.com>
date:      Tue Jun 23 22:03:06 2026 +0200
description:
        Enforce access rights on the email template record on marketing email

        Closes #14907
diffstat:

 modules/marketing_email/CHANGELOG    |  1 +
 modules/marketing_email/marketing.py |  9 ++++++++-
 2 files changed, 9 insertions(+), 1 deletions(-)

diffs (41 lines):

diff -r 5c64e83a573c -r 856dea6dca76 modules/marketing_email/CHANGELOG
--- a/modules/marketing_email/CHANGELOG Tue Jun 23 22:02:47 2026 +0200
+++ b/modules/marketing_email/CHANGELOG Tue Jun 23 22:03:06 2026 +0200
@@ -1,3 +1,4 @@
+* Enforce access rights on the email template record (issue14907)
 
 Version 8.0.0 - 2026-04-20
 --------------------------
diff -r 5c64e83a573c -r 856dea6dca76 modules/marketing_email/marketing.py
--- a/modules/marketing_email/marketing.py      Tue Jun 23 22:02:47 2026 +0200
+++ b/modules/marketing_email/marketing.py      Tue Jun 23 22:03:06 2026 +0200
@@ -17,7 +17,8 @@
 from trytond.i18n import gettext
 from trytond.ir.session import token_hex
 from trytond.model import (
-    DeactivableMixin, Index, ModelSQL, ModelView, Unique, Workflow, fields)
+    DeactivableMixin, Index, ModelAccessProxy, ModelSQL, ModelView, Unique,
+    Workflow, fields)
 from trytond.pool import Pool
 from trytond.pyson import Eval
 from trytond.report import Report, get_email, html_to_text, mjml_to_html
@@ -427,6 +428,7 @@
     def process(cls, messages=None, emails=None, smtpd_datamanager=None):
         pool = Pool()
         WebShortener = pool.get('web.shortened_url')
+        ModelData = pool.get('ir.model.data')
         spy_pixel = config.getboolean(
             'marketing', 'email_spy_pixel', default=False)
 
@@ -480,6 +482,11 @@
                         message=message.rec_name,
                         exception=exception)) from exception
             for email in (emails or message.list_.emails):
+                email = ModelAccessProxy(
+                    email, {
+                        '_groups': [
+                            ModelData.get_id('marketing.group_marketing')],
+                        })
                 content = (template
                     .generate(
                         email=email,