fix(registry): drop broken /mail/message/update_content override

spp_registry/README.rst

@@ -139,6 +139,27 @@ Dependencies
 Changelog
 =========
 
+19.0.2.2.5
+~~~~~~~~~~
+
+- fix(registry): remove the ``/mail/message/update_content`` controller
+  override. It was ported from Odoo 17, where it was already redundant:
+  stock 17 granted author-or-administrator editing too, and the override
+  only narrowed "administrator" to ``base.group_system`` and answered
+  with an access error instead of a 404. On Odoo 19 it no longer worked
+  at all, breaking **Edit** and **Delete** on every chatter message
+  across the instance: its signature still expected the Odoo 17 request
+  shape while the Odoo 19 web client sends ``update_data``, so every
+  call failed before running, and behind that it also called the removed
+  ``ir.attachment._check_attachments_access`` and returned through the
+  removed ``message_format()``. Odoo 19's own route already grants
+  author-or-administrator editing, so the override is dropped and the
+  route is stock again. Who may edit another user's chatter message
+  therefore follows Odoo's own administrator test (superuser or
+  **Administration: Access Rights**, which **Administration: Settings**
+  implies) instead of Settings only, and the editor must also be allowed
+  to post on the record; no OpenSPP role sits in that gap (#419)
+
 19.0.2.2.4
 ~~~~~~~~~~
 

spp_registry/__manifest__.py

@@ -3,7 +3,7 @@
 {
     "name": "OpenSPP Registry",
     "category": "OpenSPP/Core",
-    "version": "19.0.2.2.4",
+    "version": "19.0.2.2.5",
     "sequence": 1,
     "author": "OpenSPP.org",
     "website": "https://github.com/OpenSPP/OpenSPP2",

spp_registry/controllers/mail.py

@@ -1,6 +1,3 @@
-import logging
-
-from markupsafe import Markup
 from werkzeug.exceptions import NotFound
 
 from odoo import http
@@ -10,11 +7,8 @@
 from odoo.tools.translate import _
 
 from odoo.addons.mail.controllers.attachment import AttachmentController
-from odoo.addons.mail.controllers.thread import ThreadController
 from odoo.addons.mail.tools.discuss import add_guest_to_context
 
-logger = logging.getLogger(__name__)
-
 
 class SPPAttachmentController(AttachmentController):
     @http.route("/mail/attachment/delete", methods=["POST"], type="jsonrpc", auth="public")
@@ -54,27 +48,3 @@ def mail_attachment_delete(self, attachment_id, access_token=None):
             if attachment_sudo.res_model != "mail.compose.message" or attachment_sudo.res_id != 0:
                 raise NotFound()
         attachment_sudo._delete_and_notify(message)
-
-
-class SPPThreadController(ThreadController):
-    @http.route("/mail/message/update_content", methods=["POST"], type="jsonrpc", auth="public")
-    @add_guest_to_context
-    def mail_message_update_content(self, message_id, body, attachment_ids, attachment_tokens=None, partner_ids=None):
-        guest = request.env["mail.guest"]._get_guest_from_context()
-        guest.env["ir.attachment"].browse(attachment_ids)._check_attachments_access(attachment_tokens)
-        # nosemgrep: odoo-sudo-without-context
-        message_sudo = guest.env["mail.message"].browse(message_id).sudo().exists()
-
-        # Check if current user is admin or the creator (user or guest)
-        is_admin = request.env.user.has_group("base.group_system")
-        is_author = message_sudo.is_current_user_or_guest_author
-        if not (is_admin or is_author):
-            raise AccessError(_("You do not have permission to update this message."))
-
-        if not message_sudo.model or not message_sudo.res_id:
-            raise NotFound()
-        body = Markup(body) if body else body  # may contain HTML such as @mentions
-        guest.env[message_sudo.model].browse([message_sudo.res_id])._message_update_content(
-            message_sudo, body, attachment_ids=attachment_ids, partner_ids=partner_ids
-        )
-        return message_sudo.message_format()[0]

spp_registry/i18n/es.po

@@ -1530,12 +1530,6 @@ msgstr "No puede seleccionar una fecha de nacimiento posterior a hoy"
 msgid "You do not have permission to delete this attachment."
 msgstr "No tiene permiso para eliminar este adjunto."
 
-#. module: spp_registry
-#. odoo-python
-#: code:addons/spp_registry/controllers/mail.py:0
-msgid "You do not have permission to update this message."
-msgstr "No tiene permiso para actualizar este mensaje."
-
 #. module: spp_registry
 #. odoo-python
 #: code:addons/spp_registry/models/registrant.py:0

spp_registry/i18n/fr.po

@@ -1534,12 +1534,6 @@ msgstr ""
 msgid "You do not have permission to delete this attachment."
 msgstr "Vous n’avez pas l’autorisation de supprimer cette pièce jointe."
 
-#. module: spp_registry
-#. odoo-python
-#: code:addons/spp_registry/controllers/mail.py:0
-msgid "You do not have permission to update this message."
-msgstr "Vous n’avez pas l’autorisation de mettre à jour ce message."
-
 #. module: spp_registry
 #. odoo-python
 #: code:addons/spp_registry/models/registrant.py:0

spp_registry/i18n/spp_registry.pot

@@ -1495,12 +1495,6 @@ msgstr ""
 msgid "You do not have permission to delete this attachment."
 msgstr ""
 
-#. module: spp_registry
-#. odoo-python
-#: code:addons/spp_registry/controllers/mail.py:0
-msgid "You do not have permission to update this message."
-msgstr ""
-
 #. module: spp_registry
 #. odoo-python
 #: code:addons/spp_registry/models/registrant.py:0

spp_registry/readme/HISTORY.md

@@ -1,3 +1,7 @@
+### 19.0.2.2.5
+
+- fix(registry): remove the `/mail/message/update_content` controller override. It was ported from Odoo 17, where it was already redundant: stock 17 granted author-or-administrator editing too, and the override only narrowed "administrator" to `base.group_system` and answered with an access error instead of a 404. On Odoo 19 it no longer worked at all, breaking **Edit** and **Delete** on every chatter message across the instance: its signature still expected the Odoo 17 request shape while the Odoo 19 web client sends `update_data`, so every call failed before running, and behind that it also called the removed `ir.attachment._check_attachments_access` and returned through the removed `message_format()`. Odoo 19's own route already grants author-or-administrator editing, so the override is dropped and the route is stock again. Who may edit another user's chatter message therefore follows Odoo's own administrator test (superuser or **Administration: Access Rights**, which **Administration: Settings** implies) instead of Settings only, and the editor must also be allowed to post on the record; no OpenSPP role sits in that gap (#419)
+
 ### 19.0.2.2.4
 
 - fix(registry): refuse a date of birth in the future on every write path. `_birthdate_onchange` only runs in the form UI, so ORM `create`/`write`, CSV/Excel import and API writes (XML-RPC, API v2, DCI) all persisted a future `birthdate` — which the non-stored `age` compute then rendered as a negative number in views, exports and API reads. A stored-field constraint now enforces it server-side, comparing against the user's own today so a registrar east of UTC is not refused a birth recorded earlier that local day, and naming the record and the offending value so a bad row in a bulk import can be found. The onchange is kept as the friendlier silent-reset UX in the form (#362)

spp_registry/static/description/index.html

@@ -518,6 +518,28 @@ <h2><a class="toc-backref" href="#toc-entry-1">Changelog</a></h2>
 </div>
 </div>
 <div class="section" id="section-1">
+<h1>19.0.2.2.5</h1>
+<ul class="simple">
+<li>fix(registry): remove the <tt class="docutils literal">/mail/message/update_content</tt> controller
+override. It was ported from Odoo 17, where it was already redundant:
+stock 17 granted author-or-administrator editing too, and the override
+only narrowed “administrator” to <tt class="docutils literal">base.group_system</tt> and answered
+with an access error instead of a 404. On Odoo 19 it no longer worked
+at all, breaking <strong>Edit</strong> and <strong>Delete</strong> on every chatter message
+across the instance: its signature still expected the Odoo 17 request
+shape while the Odoo 19 web client sends <tt class="docutils literal">update_data</tt>, so every
+call failed before running, and behind that it also called the removed
+<tt class="docutils literal">ir.attachment._check_attachments_access</tt> and returned through the
+removed <tt class="docutils literal">message_format()</tt>. Odoo 19’s own route already grants
+author-or-administrator editing, so the override is dropped and the
+route is stock again. Who may edit another user’s chatter message
+therefore follows Odoo’s own administrator test (superuser or
+<strong>Administration: Access Rights</strong>, which <strong>Administration: Settings</strong>
+implies) instead of Settings only, and the editor must also be allowed
+to post on the record; no OpenSPP role sits in that gap (#419)</li>
+</ul>
+</div>
+<div class="section" id="section-2">
 <h1>19.0.2.2.4</h1>
 <ul class="simple">
 <li>fix(registry): refuse a date of birth in the future on every write
@@ -538,7 +560,7 @@ <h1>19.0.2.2.4</h1>
 <tt class="docutils literal">SELECT id, display_name, birthdate FROM res_partner WHERE birthdate &gt; CURRENT_DATE;</tt></li>
 </ul>
 </div>
-<div class="section" id="section-2">
+<div class="section" id="section-3">
 <h1>19.0.2.2.3</h1>
 <ul class="simple">
 <li>fix(registry): repair the stored <tt class="docutils literal">status</tt>/<tt class="docutils literal">is_ended</tt> computes on
@@ -562,7 +584,7 @@ <h1>19.0.2.2.3</h1>
 <tt class="docutils literal">CREATE INDEX CONCURRENTLY IF NOT EXISTS spp_group_membership__ended_date_index ON spp_group_membership (ended_date) WHERE ended_date IS NOT NULL;</tt></li>
 </ul>
 </div>
-<div class="section" id="section-3">
+<div class="section" id="section-4">
 <h1>19.0.2.2.2</h1>
 <ul class="simple">
 <li>fix(registry): let an ID type be used again after its ID was removed.
@@ -574,7 +596,7 @@ <h1>19.0.2.2.2</h1>
 surfacing a database error (#1136)</li>
 </ul>
 </div>
-<div class="section" id="section-4">
+<div class="section" id="section-5">
 <h1>19.0.2.2.1</h1>
 <ul class="simple">
 <li>feat(registry): registry configuration is consolidated into one
@@ -585,7 +607,7 @@ <h1>19.0.2.2.1</h1>
 framework refuses a settings save from anyone else (#1009)</li>
 </ul>
 </div>
-<div class="section" id="section-5">
+<div class="section" id="section-6">
 <h1>19.0.2.1.4</h1>
 <ul class="simple">
 <li>fix(registry): remove the dead <tt class="docutils literal"><span class="pre">&#64;api.constrains(&quot;age&quot;)</span></tt>
@@ -597,7 +619,7 @@ <h1>19.0.2.1.4</h1>
 dropped</li>
 </ul>
 </div>
-<div class="section" id="section-6">
+<div class="section" id="section-7">
 <h1>19.0.2.1.3</h1>
 <ul class="simple">
 <li>fix(registry): show an ID <strong>Status</strong> column on the group form
@@ -608,7 +630,7 @@ <h1>19.0.2.1.3</h1>
 (#1110)</li>
 </ul>
 </div>
-<div class="section" id="section-7">
+<div class="section" id="section-8">
 <h1>19.0.2.1.1</h1>
 <ul class="simple">
 <li>fix(views): add reusable <tt class="docutils literal">x2many_no_padding</tt> JS widget that
@@ -618,7 +640,7 @@ <h1>19.0.2.1.1</h1>
 don’t bloat the layout (#943).</li>
 </ul>
 </div>
-<div class="section" id="section-8">
+<div class="section" id="section-9">
 <h1>19.0.2.0.0</h1>
 <ul class="simple">
 <li>Initial migration to OpenSPP2</li>