This question has been flagged
1 Reply
2719 Views

I'm getting access error for website_mail.message_thread. It worked for some time and then it just stopped.

The error that I get:

AccessError: (u'The requested operation cannot be completed due to security restrictions. Please contact your system administrator.\n\n(Document type: mail.message.subtype, Operation: read)', None)

Error to render compiling AST
AccessError: (u'The requested operation cannot be completed due to security restrictions. Please contact your system administrator.\n\n(Document type: mail.message.subtype, Operation: read)', None)
Template: website_mail.message_thread
Path: /templates/t/section/ul/t[2]/t
Node: <t t-set="messages" t-value="object.message_ids.filtered(lambda m: m.subtype_id.internal == False)"/>

What security options needs the user to have to not throw this error? The messages are from a projects task.

On the website are displayed the tasks where the user is the customer and added as a follower.

Avatar
Discard
Best Answer

Hi,

The access right must be based on the user groups,  if you are looking to display the mail.message 's to the public user or the portal users on the website, then you must give them read access to this model for the public user or the portal user.

As it is custom development and to show it on the website, not sure to give for which user group, so give the user access rights accordingly.


Also, you can try with Sudo,

<t t-set="messages" t-value="object.sudo().message_ids.filtered(lambda m: m.subtype_id.internal == False)"/>


Nice to set the access rights accordingly, so that there is no need to use sudo()


Thanks

Avatar
Discard
Author

I can't use sudo() because the template code is generated.. I just use <t t-call=website_mail.message_thread>..</t>. It's weird that I can access some tasks and not others and the project and task have the same users.

Author

Yeah I went for the easy way with sudo() and now it works. I really can't figure out odoos security/access rules and how to use them.

Odoo13 will add a lot more support/help to debug problems with security access. Support for warnings about rules, related fields, groups and security records! See the PR: https://github.com/odoo/odoo/pull/30144