[tryton-commits] [tryton] [8.0] Enforce access rights on the email template recor...

[Cédric Krier]

details:   https://code.tryton.org/tryton/commit/7ac0b728aee9
branch:    8.0
user:      Cédric Krier <c...@b2ck.com>
date:      Tue Jun 30 23:08:14 2026 +0200
description:
        Enforce access rights on the email template record on marketing email

        Closes #14907
        (grafted from 856dea6dca76bd9cd7fa03a3dbe51f160b912e69)
diffstat:

 modules/marketing_email/CHANGELOG    |   1 +
 modules/marketing_email/marketing.py |  12 ++++++++++++
 2 files changed, 13 insertions(+), 0 deletions(-)

diffs (44 lines):

diff -r a0ca28193272 -r 7ac0b728aee9 modules/marketing_email/CHANGELOG
--- a/modules/marketing_email/CHANGELOG Tue Jun 30 09:48:33 2026 +0200
+++ b/modules/marketing_email/CHANGELOG Tue Jun 30 23:08:14 2026 +0200
@@ -1,3 +1,4 @@
+* Enforce access rights on the email template record (issue14907)
 
 Version 8.0.0 - 2026-04-20
 --------------------------
diff -r a0ca28193272 -r 7ac0b728aee9 modules/marketing_email/marketing.py
--- a/modules/marketing_email/marketing.py      Tue Jun 30 09:48:33 2026 +0200
+++ b/modules/marketing_email/marketing.py      Tue Jun 30 23:08:14 2026 +0200
@@ -29,6 +29,11 @@
 from trytond.url import http_base
 from trytond.wizard import Button, StateTransition, StateView, Wizard
 
+try:
+    from trytond.model import ModelAccessProxy
+except ImportError:
+    ModelAccessProxy = None
+
 from .exceptions import EMailValidationError, TemplateError
 
 
@@ -427,6 +432,7 @@
     def process(cls, messages=None, emails=None, smtpd_datamanager=None):
         pool = Pool()
         WebShortener = pool.get('web.shortened_url')
+        ModelData = pool.get('ir.model.data')
         spy_pixel = config.getboolean(
             'marketing', 'email_spy_pixel', default=False)
 
@@ -480,6 +486,12 @@
                         message=message.rec_name,
                         exception=exception)) from exception
             for email in (emails or message.list_.emails):
+                if ModelAccessProxy:
+                    email = ModelAccessProxy(
+                        email, {
+                            '_groups': [
+                                ModelData.get_id('marketing.group_marketing')],
+                            })
                 content = (template
                     .generate(
                         email=email,