[tryton-commits] [tryton] [7.0] Enforce access rights on the email template recor...

[Cédric Krier]

details:   https://code.tryton.org/tryton/commit/fc3a45f1aa31
branch:    7.0
user:      Cédric Krier <c...@b2ck.com>
date:      Tue Jun 30 23:09:36 2026 +0200
description:
        Enforce access rights on the email template record on marketing email

        Closes #14907
        (grafted from 856dea6dca76bd9cd7fa03a3dbe51f160b912e69)
diffstat:

 modules/marketing_email/CHANGELOG    |   1 +
 modules/marketing_email/marketing.py |  12 ++++++++++++
 2 files changed, 13 insertions(+), 0 deletions(-)

diffs (44 lines):

diff -r 4221d74d44d7 -r fc3a45f1aa31 modules/marketing_email/CHANGELOG
--- a/modules/marketing_email/CHANGELOG Tue Jun 30 09:48:33 2026 +0200
+++ b/modules/marketing_email/CHANGELOG Tue Jun 30 23:09:36 2026 +0200
@@ -1,3 +1,4 @@
+* Enforce access rights on the email template record (issue14907)
 
 Version 7.0.2 - 2026-03-02
 --------------------------
diff -r 4221d74d44d7 -r fc3a45f1aa31 modules/marketing_email/marketing.py
--- a/modules/marketing_email/marketing.py      Tue Jun 30 09:48:33 2026 +0200
+++ b/modules/marketing_email/marketing.py      Tue Jun 30 23:09:36 2026 +0200
@@ -38,6 +38,11 @@
 from trytond.url import http_host
 from trytond.wizard import Button, StateTransition, StateView, Wizard
 
+try:
+    from trytond.model import ModelAccessProxy
+except ImportError:
+    ModelAccessProxy = None
+
 from .exceptions import EMailValidationError, TemplateError
 
 if not config.get(
@@ -470,6 +475,7 @@
     def process(cls, messages=None, emails=None, smtpd_datamanager=None):
         pool = Pool()
         WebShortener = pool.get('web.shortened_url')
+        ModelData = pool.get('ir.model.data')
         spy_pixel = config.getboolean(
             'marketing', 'email_spy_pixel', default=False)
 
@@ -513,6 +519,12 @@
         for message in messages:
             template = MarkupTemplate(message.content)
             for email in (emails or message.list_.emails):
+                if ModelAccessProxy:
+                    email = ModelAccessProxy(
+                        email, {
+                            '_groups': [
+                                ModelData.get_id('marketing.group_marketing')],
+                            })
                 content = (template
                     .generate(email=email)
                     .filter(convert_href(message))