[FIX] fix access right public user do not have the right to read this…

… data
akretion · Sep 7, 2021 · 7ebd351 · 7ebd351
1 parent ebf1d2f
commit 7ebd351
Show file tree

Hide file tree

Showing 3 changed files with 9 additions and 5 deletions.
diff --git a/shopinvader/components/service_context_provider.py b/shopinvader/components/service_context_provider.py
@@ -43,8 +43,10 @@ def _get_backend(self):
         website_unique_key = self.request.httprequest.environ.get(
             "HTTP_WEBSITE_UNIQUE_KEY"
         )
-        return self.env["shopinvader.backend"]._get_from_website_unique_key(
-            website_unique_key
+        return (
+            self.env["shopinvader.backend"]
+            .sudo()
+            ._get_from_website_unique_key(website_unique_key)
         )
 
     def _get_component_context(self):

diff --git a/shopinvader/models/shopinvader_backend.py b/shopinvader/models/shopinvader_backend.py
@@ -572,11 +572,13 @@ def _validate_partner(self, shopinvader_partner):
     @api.model
     @tools.ormcache("self._uid", "website_unique_key")
     def _get_id_from_website_unique_key(self, website_unique_key):
-        return self.search([("website_unique_key", "=", website_unique_key)]).id
+        return self.sudo().search([("website_unique_key", "=", website_unique_key)]).id
 
     @api.model
     def _get_from_website_unique_key(self, website_unique_key):
-        return self.browse(self._get_id_from_website_unique_key(website_unique_key))
+        return self.sudo().browse(
+            self._get_id_from_website_unique_key(website_unique_key)
+        )
 
     def write(self, values):
         if "website_unique_key" in values:

diff --git a/shopinvader_auth_api_key/models/shopinvader_backend.py b/shopinvader_auth_api_key/models/shopinvader_backend.py
@@ -38,7 +38,7 @@ def _get_api_key_name(cls, auth_api_key):
     @api.model
     @tools.ormcache("self._uid", "auth_api_key_id")
     def _get_id_from_auth_api_key(self, auth_api_key_id):
-        return self.search([("auth_api_key_id", "=", auth_api_key_id)]).id
+        return self.sudo().search([("auth_api_key_id", "=", auth_api_key_id)]).id
 
     @api.model
     def _get_from_auth_api_key(self, auth_api_key_id):