From 51bbd71965157a5ddc79d943e9e53b286558ba6b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?C=C3=A9dric=20Krier?= Date: Tue, 30 Jun 2026 23:08:14 +0200 Subject: [PATCH] Enforce access rights on the email template record on marketing email Closes #14907 (grafted from 856dea6dca76bd9cd7fa03a3dbe51f160b912e69) --HG-- branch : 8.0 --- modules/marketing_email/CHANGELOG | 1 + modules/marketing_email/marketing.py | 12 ++++++++++++ 2 files changed, 13 insertions(+) diff --git a/modules/marketing_email/CHANGELOG b/modules/marketing_email/CHANGELOG index 1778f88681..a7fd07375a 100644 --- a/modules/marketing_email/CHANGELOG +++ b/modules/marketing_email/CHANGELOG @@ -1,3 +1,4 @@ +* Enforce access rights on the email template record (issue14907) Version 8.0.0 - 2026-04-20 -------------------------- diff --git a/modules/marketing_email/marketing.py b/modules/marketing_email/marketing.py index 8a2ed93b23..8b8195525a 100644 --- a/modules/marketing_email/marketing.py +++ b/modules/marketing_email/marketing.py @@ -29,6 +29,11 @@ from trytond.transaction import Transaction, inactive_records from trytond.url import http_base from trytond.wizard import Button, StateTransition, StateView, Wizard +try: + from trytond.model import ModelAccessProxy +except ImportError: + ModelAccessProxy = None + from .exceptions import EMailValidationError, TemplateError @@ -427,6 +432,7 @@ class Message(Workflow, ModelSQL, ModelView): def process(cls, messages=None, emails=None, smtpd_datamanager=None): pool = Pool() WebShortener = pool.get('web.shortened_url') + ModelData = pool.get('ir.model.data') spy_pixel = config.getboolean( 'marketing', 'email_spy_pixel', default=False) @@ -480,6 +486,12 @@ class Message(Workflow, ModelSQL, ModelView): message=message.rec_name, exception=exception)) from exception for email in (emails or message.list_.emails): + if ModelAccessProxy: + email = ModelAccessProxy( + email, { + '_groups': [ + ModelData.get_id('marketing.group_marketing')], + }) content = (template .generate( email=email,