[18.0][FIX] mail_notification_custom_subject: read templates with sudo

mail_notification_custom_subject/README.rst

@@ -101,6 +101,10 @@ Contributors
 
   - Eduardo de Miguel
 
+- Codeforward <https://www.codeforward.nl>
+
+  - Sander Lienaerts
+
 Maintainers
 -----------
 

mail_notification_custom_subject/__manifest__.py

@@ -5,7 +5,7 @@
 {
     "name": "Mail Notification Custom Subject",
     "summary": "Apply a custom subject to mail notifications",
-    "version": "18.0.1.0.0",
+    "version": "18.0.1.0.1",
     "category": "Social Network",
     "website": "https://github.com/OCA/mail",
     "author": "Tecnativa, Odoo Community Association (OCA)",

mail_notification_custom_subject/models/mail_thread.py

@@ -46,11 +46,12 @@ def message_post(
             if subject:
                 # If it already had a defined subject, we must respect it
                 domain += [("position", "!=", "replace")]
+            # Read templates with sudo: they are admin-managed configuration
+            # records, akin to mail.template. Portal and public users may
+            # trigger message_post (e.g. via portal controllers) and must be
+            # able to iterate the templates without hitting ACL errors.
             custom_subjects = (
-                self.env["mail.message.custom.subject"]
-                .sudo()
-                .search(domain)
-                .sudo(False)
+                self.env["mail.message.custom.subject"].sudo().search(domain)
             )
             if not subject:
                 record_name = (

mail_notification_custom_subject/readme/CONTRIBUTORS.md

@@ -10,3 +10,6 @@
 
 - Moduon \<<https://www.moduon.team>\>  
   - Eduardo de Miguel
+
+- Codeforward \<<https://www.codeforward.nl>\>  
+  - Sander Lienaerts

mail_notification_custom_subject/tests/test_mail_notification_custom_subject.py

@@ -20,6 +20,7 @@ def setUpClass(cls):
         )
         cls.admin = new_test_user(cls.env, "boss", "base.group_system")
         new_test_user(cls.env, "worker_custom_subject")
+        new_test_user(cls.env, "portal_custom_subject", "base.group_portal")
         cls.subject_model = cls.env["mail.message.custom.subject"].with_user(cls.admin)
 
     @users("worker_custom_subject")
@@ -210,3 +211,32 @@ def test_no_template_default_result(self):
         # Get message and check subject
         # No exception should be raised but subject should remain as original.
         self.assertEqual(mail_message_1.subject, "Test partner 1")
+
+    @users("portal_custom_subject")
+    def test_email_subject_template_portal_user(self):
+        """Portal users triggering message_post via sudo (e.g. from a portal
+        controller) must render custom subject templates without hitting ACL
+        errors on mail.message.custom.subject — templates are admin-managed
+        configuration records and should be read with sudo."""
+        self.subject_model.create(
+            {
+                "name": "Test portal template",
+                "model_id": self.env.ref("base.model_res_partner").id,
+                "subtype_ids": [(6, 0, [self.env.ref("mail.mt_comment").id])],
+                "subject_template": "{{object.name or 'n/a'}} - portal",
+            }
+        )
+        portal_user = self.env.user
+        self.assertTrue(portal_user.has_group("base.group_portal"))
+        self.assertFalse(portal_user.has_group("base.group_user"))
+        # Mimic the portal controller pattern: the caller is the portal user,
+        # the record is sudo'd for message_post, and author_id is set to the
+        # portal user's partner.
+        partner = self.env["res.partner"].browse(self.partner_1.id)
+        mail_message = partner.sudo().message_post(
+            body="Test from portal",
+            subtype_xmlid="mail.mt_comment",
+            author_id=portal_user.partner_id.id,
+        )
+        self.assertEqual(mail_message.author_id, portal_user.partner_id)
+        self.assertEqual(mail_message.subject, "Test partner 1 - portal")