-
- Downloads
[FIX] survey: Don't load answer from other user if a cookie exists
To reproduce the issue: 1) Create a survey requiring user login, with multiple pages 2) Create portal user A and B 3) With user A, go to URL /survey/start/****, where **** is the access token of your test survey. Fill in the first pages of the survey, but don't finish your submission (so: the answer has to stay 'in progress'). 4) Logout from user A. 5) From the same browser window (or without cleaning cookies, at least), directly login with user B, and go to the same /survey/start/**** link ====> The 'in progress' answer from A is loaded, even though we are connected with B and should hence not have access to it. Instead, we should have created a new blank answer for B. This is due to our cookie management. When a cookie is kept in the browser with the token of a previously entered answer, we reload it without checking its owner. Task-2729738 Part-of: odoo/odoo#82041
Loading
Please register or sign in to comment