fixed download button for portal users on documents.

bemade_documents_portal/controllers/portal.py

@@ -1,4 +1,4 @@
-from odoo.addons.portal.controllers.portal import CustomerPortal
+from odoo.addons.portal.controllers.portal import CustomerPortal
 from odoo.http import request, route
 from odoo.exceptions import AccessError, MissingError
 from odoo import _
@@ -28,9 +28,9 @@ class DocumentCustomerPortal(CustomerPortal):
         return request.render("bemade_documents_portal.portal_my_documents", values)
 
     def _prepare_documents_domain(self):
+        """Helper method intended to be overridden for future modules."""
         partner = request.env.user.partner_id
         user = request.env.user
-        """Helper method intended to be overridden for future modules."""
         return ['|',
                 ('partner_id', '=', partner.id),
                 ('owner_id', '=', user.id),
@@ -48,7 +48,7 @@ class DocumentCustomerPortal(CustomerPortal):
             raise MissingError(_('This document does not exist.'))
         if download:
             return self._download_attachment(document)
-        values={
+        values = {
             'document': document,
             'page_name': 'my_documents',
             'action': document._get_portal_return_action(),
@@ -56,10 +56,33 @@ class DocumentCustomerPortal(CustomerPortal):
         return self._render_record_template(values)
 
     def _download_attachment(self, document):
-        attachment = document.attachment_id
+        partner = request.env.user.partner_id
+        if partner and self._check_portal_access(document, partner):
+            attachment = document.attachment_id.sudo()
         headers = [
             ('content-type', attachment.mimetype),
             ('content-length', attachment.file_size),
             ('content-disposition', f'attachment; filename="{document.name}"')
         ]
         return request.make_response(attachment.raw, headers)
+
+    def _check_portal_access(self, document, partner) -> bool:
+        """
+        Helper method to determine if a given partner has access to a document.
+
+        This method is intended to be overridden should further access rights be granted.
+
+        Note that this method does NOT replace the user-level ACL verification and is
+        instead used to bypass these ACL checks when portal users are trying to download
+        a document.
+
+        In overriding, one should generally use the following form::
+
+            new_condition = ...
+            return super()._check_portal_access or new_condition
+
+        :param document: The document in question.
+        :param partner: The res_partner to check for portal access.
+        :return: True if the partner should have access to the document, False otherwise.
+        """
+        return partner == document.partner_id

bemade_project_documents/__manifest__.py

@@ -0,0 +1,35 @@
+#
+#    Bemade Inc.
+#
+#    Copyright (C) September 2023 Bemade Inc. (<https://www.bemade.org>).
+#    Author: Marc Durepos (Contact : marc@bemade.org)
+#
+#    This program is under the terms of the Odoo Proprietary License v1.0 (OPL-1)
+#    It is forbidden to publish, distribute, sublicense, or sell copies of the Software
+#    or modified copies of the Software.
+#
+#    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+#    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+#    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+#    IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
+#    DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+#    ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+#    DEALINGS IN THE SOFTWARE.
+#
+{
+    'name': 'Project Documents',
+    'version': '15.0.1.0.0',
+    'summary': 'Improved workflow for project documents.',
+    'description': """Adds multiple workflow items to project documents, including:
+                        * Approval stages
+                        * Document versions with revision numbers""",
+    'category': '',
+    'author': 'Bemade Inc.',
+    'website': 'https://www.bemade.org',
+    'license': 'OPL-1',
+    'depends': [],
+    'data': [],
+    'demo': [],
+    'installable': True,
+    'auto_install': False,
+}