Enforce access rights on the email template record of marketing automation

Closes #14907
(grafted from 5c64e83a573ce01423a4d65a25fe704b39a43306)

--HG--
branch : 8.0

modules/marketing_automation/CHANGELOG

@@ -1,3 +1,4 @@
+* Enforce access rights on the email template record (issue14907)
 
 Version 8.0.0 - 2026-04-20
 --------------------------

modules/marketing_automation/marketing_automation.py

@@ -33,6 +33,11 @@ from trytond.transaction import Transaction
 from trytond.url import http_base
 from trytond.wsgi import Base64Converter
 
+try:
+    from trytond.model import ModelAccessProxy
+except ImportError:
+    ModelAccessProxy = None
+
 from .exceptions import ConditionError, DomainError, TemplateError
 from .mixin import MarketingAutomationMixin
 
@@ -728,8 +733,13 @@ class Activity(
             email.save()
 
     def email_context(self, record):
+        if ModelAccessProxy:
+            record = ModelAccessProxy(
+                record.record, record.record.marketing_access_context)
+        else:
+            record = record.record
         return {
-            'record': record.record,
+            'record': record,
             'format_date': Report.format_date,
             'format_datetime': Report.format_datetime,
             'format_timedelta': Report.format_timedelta,

modules/marketing_automation/mixin.py

@@ -2,6 +2,7 @@
 # this repository contains the full copyright notices and license terms.
 
 from trytond.model import fields
+from trytond.pool import Pool
 
 
 class MarketingAutomationMixin:
@@ -17,3 +18,11 @@ class MarketingAutomationMixin:
     @classmethod
     def search_marketing_party(cls, name, clause):
         raise NotImplementedError
+
+    @property
+    def marketing_access_context(self):
+        pool = Pool()
+        ModelData = pool.get('ir.model.data')
+        return {
+            '_groups': [ModelData.get_id('marketing.group_marketing')],
+            }

modules/marketing_automation/sale.py

@@ -1,7 +1,7 @@
 # This file is part of Tryton.  The COPYRIGHT file at the top level of
 # this repository contains the full copyright notices and license terms.
 
-from trytond.pool import PoolMeta
+from trytond.pool import Pool, PoolMeta
 
 from .mixin import MarketingAutomationMixin
 
@@ -16,3 +16,14 @@ class Sale(MarketingAutomationMixin, metaclass=PoolMeta):
     def search_marketing_party(cls, name, clause):
         nested = clause[0][len(name):]
         return [('party' + nested, *clause[1:])]
+
+    @property
+    def marketing_access_context(self):
+        pool = Pool()
+        ModelData = pool.get('ir.model.data')
+        context = super().marketing_access_context
+        context.setdefault('_groups', []).append(
+            ModelData.get_id('sale.group_sale'))
+        context.setdefault('_companies', []).append(
+            self.company.id)
+        return context