Version in base suite: 7.0.0-3

Base version: tryton-modules-marketing-email_7.0.0-3
Target version: tryton-modules-marketing-email_7.0.0-3deb13u1
Base file: /srv/ftp-master.debian.org/ftp/pool/main/t/tryton-modules-marketing-email/tryton-modules-marketing-email_7.0.0-3.dsc
Target file: /srv/ftp-master.debian.org/policy/pool/main/t/tryton-modules-marketing-email/tryton-modules-marketing-email_7.0.0-3deb13u1.dsc

 changelog                                                                              |   13 ++
 patches/01_enforce_access_rights_on_the_email_template_record_of_marketing_email.patch |   46 ++++++++++
 patches/series                                                                         |    1 
 3 files changed, 60 insertions(+)

dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpfwgxu7u_/tryton-modules-marketing-email_7.0.0-3.dsc: no acceptable signature found
dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpfwgxu7u_/tryton-modules-marketing-email_7.0.0-3deb13u1.dsc: no acceptable signature found
diff -Nru tryton-modules-marketing-email-7.0.0/debian/changelog tryton-modules-marketing-email-7.0.0/debian/changelog
--- tryton-modules-marketing-email-7.0.0/debian/changelog	2024-10-25 10:55:44.000000000 +0000
+++ tryton-modules-marketing-email-7.0.0/debian/changelog	2026-09-02 14:48:39.000000000 +0000
@@ -1,3 +1,16 @@
+tryton-modules-marketing-email (7.0.0-3deb13u1) trixie-security; urgency=high
+
+  * Add 01_enforce_access_rights_on_the_email_template_record_of_marketing
+    _email.patch.
+    Enforce access rights on email template records
+    From https://discuss.tryton.org/t/security-release-for-issue-14907:
+    Cédric Krier has discovered that access is not enforced when browsing
+    record instances in templates.
+    This patch also neeeds ModelAccessProxy
+    https://foss.heptapod.net/tryton/tryton/-/merge_requests/3431
+
+ -- Mathias Behrle <mathiasb@m9s.biz>  Wed, 02 Sep 2026 16:48:39 +0200
+
 tryton-modules-marketing-email (7.0.0-3) unstable; urgency=medium
 
   * Use unittest.discover to run autopkgtests.
diff -Nru tryton-modules-marketing-email-7.0.0/debian/patches/01_enforce_access_rights_on_the_email_template_record_of_marketing_email.patch tryton-modules-marketing-email-7.0.0/debian/patches/01_enforce_access_rights_on_the_email_template_record_of_marketing_email.patch
--- tryton-modules-marketing-email-7.0.0/debian/patches/01_enforce_access_rights_on_the_email_template_record_of_marketing_email.patch	1970-01-01 00:00:00.000000000 +0000
+++ tryton-modules-marketing-email-7.0.0/debian/patches/01_enforce_access_rights_on_the_email_template_record_of_marketing_email.patch	2026-09-02 14:45:25.000000000 +0000
@@ -0,0 +1,46 @@
+Description: Enforce access rights on email template records
+ From https://discuss.tryton.org/t/security-release-for-issue-14907:
+ Cédric Krier has discovered that access is not enforced when browsing
+ record instances in templates.
+ 
+ This patch also neeeds ModelAccessProxy
+ https://foss.heptapod.net/tryton/tryton/-/merge_requests/3431
+Author: Cédric Krier <cedric.krier@b2ck.com>
+Last-Update: 2026-09-02
+Bug-Upstream: https://bugs.tryton.org/14907
+
+--- a/marketing.py
++++ b/marketing.py
+@@ -38,6 +38,11 @@
+ from trytond.url import http_host
+ from trytond.wizard import Button, StateTransition, StateView, Wizard
+ 
++try:
++    from trytond.model import ModelAccessProxy
++except ImportError:
++    ModelAccessProxy = None
++
+ from .exceptions import EMailValidationError, TemplateError
+ 
+ if not config.get(
+@@ -464,6 +469,7 @@
+     def process(cls, messages=None, emails=None, smtpd_datamanager=None):
+         pool = Pool()
+         WebShortener = pool.get('web.shortened_url')
++        ModelData = pool.get('ir.model.data')
+         spy_pixel = config.getboolean(
+             'marketing', 'email_spy_pixel', default=False)
+ 
+@@ -507,6 +513,12 @@
+         for message in messages:
+             template = MarkupTemplate(message.content)
+             for email in (emails or message.list_.emails):
++                if ModelAccessProxy:
++                    email = ModelAccessProxy(
++                        email, {
++                            '_groups': [
++                                ModelData.get_id('marketing.group_marketing')],
++                            })
+                 content = (template
+                     .generate(email=email)
+                     .filter(convert_href(message))
diff -Nru tryton-modules-marketing-email-7.0.0/debian/patches/series tryton-modules-marketing-email-7.0.0/debian/patches/series
--- tryton-modules-marketing-email-7.0.0/debian/patches/series	1970-01-01 00:00:00.000000000 +0000
+++ tryton-modules-marketing-email-7.0.0/debian/patches/series	2026-09-02 14:36:04.000000000 +0000
@@ -0,0 +1 @@
+01_enforce_access_rights_on_the_email_template_record_of_marketing_email.patch