Skip to content

feat: mail notification custom subject before official migration R-18158 - #21

Merged
DancejovaK merged 23 commits into
19.0from
pr-221-mail-notification-custom-subject
Jul 20, 2026
Merged

feat: mail notification custom subject before official migration R-18158#21
DancejovaK merged 23 commits into
19.0from
pr-221-mail-notification-custom-subject

Conversation

@DancejovaK

Copy link
Copy Markdown

No description provided.

joao-p-marques and others added 23 commits July 2, 2026 15:40
…l notifications

This module allows you to specify templates to override the subject on the notification
emails sent by Odoo.

TT27191

Co-authored-by: Pedro M. Baeza <pedro.baeza@tecnativa.com>
TT36470

[UPD] Update mail_notification_custom_subject.pot

[UPD] README.rst

Update translation files

Updated by "Update PO files to match POT (msgmerge)" hook in Weblate.

Translation: social-15.0/social-15.0-mail_notification_custom_subject
Translate-URL: https://translation.odoo-community.org/projects/social-15-0/social-15-0-mail_notification_custom_subject/
… send messages

After installing the module, any user was required to have admin rights to be able to search across models.

This fix does just that search with sudo and returns back to non-sudo mode immediately after. This way, we don't need to increase permissions for everybody.

Tests now run unprivileged, to assert this problem never happens again.

@moduon MT-1644 MT-1645
[UPD] README.rst

mail_notification_custom_subject 15.0.1.0.1
…n selecting subtype_id

[UPD] README.rst

mail_notification_custom_subject 15.0.1.0.2
…ert syntaxis of jinja2 to jinja3

[UPD] README.rst
[UPD] Update mail_notification_custom_subject.pot

[BOT] post-merge updates

Update translation files

Updated by "Update PO files to match POT (msgmerge)" hook in Weblate.

Translation: social-17.0/social-17.0-mail_notification_custom_subject
Translate-URL: https://translation.odoo-community.org/projects/social-17-0/social-17-0-mail_notification_custom_subject/
…ld translatable

TT52259

[BOT] post-merge updates
… it is already set

If we write something from the mail thread (without subject) it is only when it should replace the subject.

TT52259
Example use Case:
Our company is called: MY_COMPANY_NAME but is known as MCN,
we want to replace in some places the subject line so that it is sent with MCN

TT52259

[UPD] Update mail_notification_custom_subject.pot

[BOT] post-merge updates

Update translation files

Updated by "Update PO files to match POT (msgmerge)" hook in Weblate.

Translation: social-17.0/social-17.0-mail_notification_custom_subject
Translate-URL: https://translation.odoo-community.org/projects/social-17-0/social-17-0-mail_notification_custom_subject/
The mail.thread override searches mail.message.custom.subject with sudo
and then explicitly drops back to the caller's env with .sudo(False).
When iterating the resulting recordset, field reads trigger ACL checks
against the caller.

Portal and public users are allowed to trigger message_post through
portal controllers (which typically call record.sudo().message_post),
but they lack read access to mail.message.custom.subject — an
internal-only ACL. The resulting AccessError is silently caught by the
per-template try/except, but the custom subject is never applied for
those users, and the raw AccessError can leak when field access is
triggered outside the try block (e.g. via prefetch on related fields).

Templates are admin-managed configuration records, akin to
mail.template. They should be read with sudo, while rendering still
honors the caller's permissions on the business record via res_ids.

Add a test that reproduces the portal-user path: runs as a portal user
(asserts base.group_portal / not base.group_user), posts via
partner.sudo().message_post(..., author_id=portal_user.partner_id) —
the exact pattern used by portal controllers. Without the fix the
subject falls back to the default "Re: <name>"; with the fix it is
rendered from the template.
@DancejovaK
DancejovaK merged commit c19202d into 19.0 Jul 20, 2026
4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.