details: https://code.tryton.org/tryton/commit/5c64e83a573c
branch: default
user: Cédric Krier <[email protected]>
date: Tue Jun 23 22:02:47 2026 +0200
description:
Enforce access rights on the email template record of marketing
automation
Closes #14907
diffstat:
modules/marketing_automation/CHANGELOG | 1 +
modules/marketing_automation/marketing_automation.py | 8 +++++---
modules/marketing_automation/mixin.py | 9 +++++++++
modules/marketing_automation/sale.py | 13 ++++++++++++-
4 files changed, 27 insertions(+), 4 deletions(-)
diffs (84 lines):
diff -r d9aa2de5dabe -r 5c64e83a573c modules/marketing_automation/CHANGELOG
--- a/modules/marketing_automation/CHANGELOG Tue Jun 30 09:48:33 2026 +0200
+++ b/modules/marketing_automation/CHANGELOG Tue Jun 23 22:02:47 2026 +0200
@@ -1,3 +1,4 @@
+* Enforce access rights on the email template record (issue14907)
Version 8.0.0 - 2026-04-20
--------------------------
diff -r d9aa2de5dabe -r 5c64e83a573c
modules/marketing_automation/marketing_automation.py
--- a/modules/marketing_automation/marketing_automation.py Tue Jun 30
09:48:33 2026 +0200
+++ b/modules/marketing_automation/marketing_automation.py Tue Jun 23
22:02:47 2026 +0200
@@ -20,8 +20,8 @@
import trytond.config as config
from trytond.i18n import gettext
from trytond.model import (
- EvalEnvironment, Index, ModelSQL, ModelView, Unique, Workflow, dualmethod,
- fields)
+ EvalEnvironment, Index, ModelAccessProxy, ModelSQL, ModelView, Unique,
+ Workflow, dualmethod, fields)
from trytond.pool import Pool
from trytond.pyson import Eval, If, PYSONDecoder, TimeDelta
from trytond.report import Report, html_to_text, mjml_to_html
@@ -728,8 +728,10 @@
email.save()
def email_context(self, record):
+ record = ModelAccessProxy(
+ record.record, record.record.marketing_access_context)
return {
- 'record': record.record,
+ 'record': record,
'format_date': Report.format_date,
'format_datetime': Report.format_datetime,
'format_timedelta': Report.format_timedelta,
diff -r d9aa2de5dabe -r 5c64e83a573c modules/marketing_automation/mixin.py
--- a/modules/marketing_automation/mixin.py Tue Jun 30 09:48:33 2026 +0200
+++ b/modules/marketing_automation/mixin.py Tue Jun 23 22:02:47 2026 +0200
@@ -2,6 +2,7 @@
# this repository contains the full copyright notices and license terms.
from trytond.model import fields
+from trytond.pool import Pool
class MarketingAutomationMixin:
@@ -17,3 +18,11 @@
@classmethod
def search_marketing_party(cls, name, clause):
raise NotImplementedError
+
+ @property
+ def marketing_access_context(self):
+ pool = Pool()
+ ModelData = pool.get('ir.model.data')
+ return {
+ '_groups': [ModelData.get_id('marketing.group_marketing')],
+ }
diff -r d9aa2de5dabe -r 5c64e83a573c modules/marketing_automation/sale.py
--- a/modules/marketing_automation/sale.py Tue Jun 30 09:48:33 2026 +0200
+++ b/modules/marketing_automation/sale.py Tue Jun 23 22:02:47 2026 +0200
@@ -1,7 +1,7 @@
# This file is part of Tryton. The COPYRIGHT file at the top level of
# this repository contains the full copyright notices and license terms.
-from trytond.pool import PoolMeta
+from trytond.pool import Pool, PoolMeta
from .mixin import MarketingAutomationMixin
@@ -16,3 +16,14 @@
def search_marketing_party(cls, name, clause):
nested = clause[0][len(name):]
return [('party' + nested, *clause[1:])]
+
+ @property
+ def marketing_access_context(self):
+ pool = Pool()
+ ModelData = pool.get('ir.model.data')
+ context = super().marketing_access_context
+ context.setdefault('_groups', []).append(
+ ModelData.get_id('sale.group_sale'))
+ context.setdefault('_companies', []).append(
+ self.company.id)
+ return context
