[tryton-commits] [tryton] [7.0] Enforce access rights on the email template recor...

[Cédric Krier]

details:   https://code.tryton.org/tryton/commit/b2efec2dd15d
branch:    7.0
user:      Cédric Krier <c...@b2ck.com>
date:      Tue Jun 30 23:05:09 2026 +0200
description:
        Enforce access rights on the email template record of marketing 
automation

        Closes #14907
        (grafted from 5c64e83a573ce01423a4d65a25fe704b39a43306)
diffstat:

 modules/marketing_automation/CHANGELOG               |   1 +
 modules/marketing_automation/marketing_automation.py |  12 +++++++++++-
 modules/marketing_automation/mixin.py                |   9 +++++++++
 modules/marketing_automation/sale.py                 |  13 ++++++++++++-
 4 files changed, 33 insertions(+), 2 deletions(-)

diffs (88 lines):

diff -r 4f0f139b4cb6 -r b2efec2dd15d modules/marketing_automation/CHANGELOG
--- a/modules/marketing_automation/CHANGELOG    Wed Jul 01 00:46:07 2026 +0200
+++ b/modules/marketing_automation/CHANGELOG    Tue Jun 30 23:05:09 2026 +0200
@@ -1,3 +1,4 @@
+* Enforce access rights on the email template record (issue14907)
 
 Version 7.0.3 - 2026-03-02
 --------------------------
diff -r 4f0f139b4cb6 -r b2efec2dd15d 
modules/marketing_automation/marketing_automation.py
--- a/modules/marketing_automation/marketing_automation.py      Wed Jul 01 
00:46:07 2026 +0200
+++ b/modules/marketing_automation/marketing_automation.py      Tue Jun 30 
23:05:09 2026 +0200
@@ -37,6 +37,11 @@
 from trytond.url import http_host
 from trytond.wsgi import Base64Converter
 
+try:
+    from trytond.model import ModelAccessProxy
+except ImportError:
+    ModelAccessProxy = None
+
 from .exceptions import ConditionError, DomainError, TemplateError
 from .mixin import MarketingAutomationMixin
 
@@ -632,8 +637,13 @@
             email.save()
 
     def email_context(self, record):
+        if ModelAccessProxy:
+            record = ModelAccessProxy(
+                record.record, record.record.marketing_access_context)
+        else:
+            record = record.record
         return {
-            'record': record.record,
+            'record': record,
             'format_date': Report.format_date,
             'format_datetime': Report.format_datetime,
             'format_timedelta': Report.format_timedelta,
diff -r 4f0f139b4cb6 -r b2efec2dd15d modules/marketing_automation/mixin.py
--- a/modules/marketing_automation/mixin.py     Wed Jul 01 00:46:07 2026 +0200
+++ b/modules/marketing_automation/mixin.py     Tue Jun 30 23:05:09 2026 +0200
@@ -2,6 +2,7 @@
 # this repository contains the full copyright notices and license terms.
 
 from trytond.model import fields
+from trytond.pool import Pool
 
 
 class MarketingAutomationMixin:
@@ -17,3 +18,11 @@
     @classmethod
     def search_marketing_party(cls, name, clause):
         raise NotImplementedError
+
+    @property
+    def marketing_access_context(self):
+        pool = Pool()
+        ModelData = pool.get('ir.model.data')
+        return {
+            '_groups': [ModelData.get_id('marketing.group_marketing')],
+            }
diff -r 4f0f139b4cb6 -r b2efec2dd15d modules/marketing_automation/sale.py
--- a/modules/marketing_automation/sale.py      Wed Jul 01 00:46:07 2026 +0200
+++ b/modules/marketing_automation/sale.py      Tue Jun 30 23:05:09 2026 +0200
@@ -1,7 +1,7 @@
 # This file is part of Tryton.  The COPYRIGHT file at the top level of
 # this repository contains the full copyright notices and license terms.
 
-from trytond.pool import PoolMeta
+from trytond.pool import Pool, PoolMeta
 
 from .mixin import MarketingAutomationMixin
 
@@ -16,3 +16,14 @@
     def search_marketing_party(cls, name, clause):
         nested = clause[0][len(name):]
         return [('party' + nested, *clause[1:])]
+
+    @property
+    def marketing_access_context(self):
+        pool = Pool()
+        ModelData = pool.get('ir.model.data')
+        context = super().marketing_access_context
+        context.setdefault('_groups', []).append(
+            ModelData.get_id('sale.group_sale'))
+        context.setdefault('_companies', []).append(
+            self.company.id)
+        return context