Merge lp:~openerp-dev/openobject-addons/trunk-bug-1172210-nco into lp:openobject-addons

[Nimesh Contractor(Open ERP)]

Hello,

 Change the domain force of the record rule, so anonymous can see Portal images.

Thanks.

[Thibault Delavallée (OpenERP) (tde-openerp)]

Hello,

This merge proposal does not solve the bug. The bug is that anonymous users that see messages try to see the avatar of the authors. However, anonymous user have no access to res.partner model. They can not access partner.image_small, leading to void images in Chatter.

The good way to fix it is to always allow to see a partner avatar (image, image_medium and image_small fields), whatever the access rules defined on res.partner. You should check in the controller how avatars are fetched or put into cache, see if the bug can be solved in the controler, or somewhere else (in the read of res.partner maybe ?).

review: Needs Fixing

Unmerged revisions

8698. By Ishwar Malvi(OpenERP) on 2013-05-08

[FIX] Anonymous can't see Portal images. by changing the domain force.

=== modified file 'portal/security/portal_security.xml'
--- portal/security/portal_security.xml	2012-12-17 15:04:58 +0000
+++ portal/security/portal_security.xml	2013-05-08 13:03:28 +0000
@@ -5,7 +5,7 @@
         <record id="portal_read_own_res_partner" model="ir.rule">
             <field name="name">res_partner: read access on my partner</field>
             <field name="model_id" ref="base.model_res_partner"/>
-            <field name="domain_force">[('user_ids', 'in', user.id)]</field>
+            <field name="domain_force">['|',('user_id','=',user.id),('user_id','=',False)]</field>
             <field name="groups" eval="[(4, ref('group_portal')), (4, ref('group_anonymous'))]"/>
             <field name="perm_create" eval="False"/>
             <field name="perm_unlink" eval="False"/>