Enforce access rights on the email template record of marketing automation

Closes #14907

modules/marketing_automation/CHANGELOG

@@ -1,3 +1,4 @@
+* Enforce access rights on the email template record (issue14907)
 
 Version 8.0.0 - 2026-04-20
 --------------------------

modules/marketing_automation/marketing_automation.py

@@ -20,8 +20,8 @@ from sql.aggregate import Count
 import trytond.config as config
 from trytond.i18n import gettext
 from trytond.model import (
-    EvalEnvironment, Index, ModelSQL, ModelView, Unique, Workflow, dualmethod,
-    fields)
+    EvalEnvironment, Index, ModelAccessProxy, ModelSQL, ModelView, Unique,
+    Workflow, dualmethod, fields)
 from trytond.pool import Pool
 from trytond.pyson import Eval, If, PYSONDecoder, TimeDelta
 from trytond.report import Report, html_to_text, mjml_to_html
@@ -728,8 +728,10 @@ class Activity(
             email.save()
 
     def email_context(self, record):
+        record = ModelAccessProxy(
+            record.record, record.record.marketing_access_context)
         return {
-            'record': record.record,
+            'record': record,
             'format_date': Report.format_date,
             'format_datetime': Report.format_datetime,
             'format_timedelta': Report.format_timedelta,

modules/marketing_automation/mixin.py

@@ -2,6 +2,7 @@
 # this repository contains the full copyright notices and license terms.
 
 from trytond.model import fields
+from trytond.pool import Pool
 
 
 class MarketingAutomationMixin:
@@ -17,3 +18,11 @@ class MarketingAutomationMixin:
     @classmethod
     def search_marketing_party(cls, name, clause):
         raise NotImplementedError
+
+    @property
+    def marketing_access_context(self):
+        pool = Pool()
+        ModelData = pool.get('ir.model.data')
+        return {
+            '_groups': [ModelData.get_id('marketing.group_marketing')],
+            }

modules/marketing_automation/sale.py

@@ -1,7 +1,7 @@
 # This file is part of Tryton.  The COPYRIGHT file at the top level of
 # this repository contains the full copyright notices and license terms.
 
-from trytond.pool import PoolMeta
+from trytond.pool import Pool, PoolMeta
 
 from .mixin import MarketingAutomationMixin
 
@@ -16,3 +16,14 @@ class Sale(MarketingAutomationMixin, metaclass=PoolMeta):
     def search_marketing_party(cls, name, clause):
         nested = clause[0][len(name):]
         return [('party' + nested, *clause[1:])]
+
+    @property
+    def marketing_access_context(self):
+        pool = Pool()
+        ModelData = pool.get('ir.model.data')
+        context = super().marketing_access_context
+        context.setdefault('_groups', []).append(
+            ModelData.get_id('sale.group_sale'))
+        context.setdefault('_companies', []).append(
+            self.company.id)
+        return context