fixed download button for portal users on documents.

This commit is contained in:
Marc Durepos 2023-09-26 10:53:33 -04:00
parent e1576aba18
commit 9a4d145537
2 changed files with 62 additions and 4 deletions

View file

@ -1,4 +1,4 @@
from odoo.addons.portal.controllers.portal import CustomerPortal
from odoo.addons.portal.controllers.portal import CustomerPortal
from odoo.http import request, route
from odoo.exceptions import AccessError, MissingError
from odoo import _
@ -28,9 +28,9 @@ class DocumentCustomerPortal(CustomerPortal):
return request.render("bemade_documents_portal.portal_my_documents", values)
def _prepare_documents_domain(self):
"""Helper method intended to be overridden for future modules."""
partner = request.env.user.partner_id
user = request.env.user
"""Helper method intended to be overridden for future modules."""
return ['|',
('partner_id', '=', partner.id),
('owner_id', '=', user.id),
@ -48,7 +48,7 @@ class DocumentCustomerPortal(CustomerPortal):
raise MissingError(_('This document does not exist.'))
if download:
return self._download_attachment(document)
values={
values = {
'document': document,
'page_name': 'my_documents',
'action': document._get_portal_return_action(),
@ -56,10 +56,33 @@ class DocumentCustomerPortal(CustomerPortal):
return self._render_record_template(values)
def _download_attachment(self, document):
attachment = document.attachment_id
partner = request.env.user.partner_id
if partner and self._check_portal_access(document, partner):
attachment = document.attachment_id.sudo()
headers = [
('content-type', attachment.mimetype),
('content-length', attachment.file_size),
('content-disposition', f'attachment; filename="{document.name}"')
]
return request.make_response(attachment.raw, headers)
def _check_portal_access(self, document, partner) -> bool:
"""
Helper method to determine if a given partner has access to a document.
This method is intended to be overridden should further access rights be granted.
Note that this method does NOT replace the user-level ACL verification and is
instead used to bypass these ACL checks when portal users are trying to download
a document.
In overriding, one should generally use the following form::
new_condition = ...
return super()._check_portal_access or new_condition
:param document: The document in question.
:param partner: The res_partner to check for portal access.
:return: True if the partner should have access to the document, False otherwise.
"""
return partner == document.partner_id

View file

@ -0,0 +1,35 @@
#
# Bemade Inc.
#
# Copyright (C) September 2023 Bemade Inc. (<https://www.bemade.org>).
# Author: Marc Durepos (Contact : marc@bemade.org)
#
# This program is under the terms of the Odoo Proprietary License v1.0 (OPL-1)
# It is forbidden to publish, distribute, sublicense, or sell copies of the Software
# or modified copies of the Software.
#
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
# IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
# DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
# ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
# DEALINGS IN THE SOFTWARE.
#
{
'name': 'Project Documents',
'version': '15.0.1.0.0',
'summary': 'Improved workflow for project documents.',
'description': """Adds multiple workflow items to project documents, including:
* Approval stages
* Document versions with revision numbers""",
'category': '',
'author': 'Bemade Inc.',
'website': 'https://www.bemade.org',
'license': 'OPL-1',
'depends': [],
'data': [],
'demo': [],
'installable': True,
'auto_install': False,
}