pengyuthon/odoo_source
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[FIX] website_mail: fixed is_follower controller, that could leak data about records.

Browse Source 
Added instead a controller to get alias data. This controller is called by the
discussion group snippet to have the info about the alias.
This commit is contained in:
Thibault Delavallée
2014-05-28 09:59:31 +02:00
parent b4adf79ea7
commit 02018563b3
2 changed files with 38 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
addons/website_mail/controllers/main.py
+18 -3
View File
@@ -83,6 +83,7 @@ class WebsiteMail(http.Controller):
'is_user': uid != public_id,
'email': email,
'is_follower': False,
'alias_name': False,
}
if not obj:
@@ -97,8 +98,22 @@ class WebsiteMail(http.Controller):
('res_id', '=', obj_ids[0]),
('partner_id', '=', partner_id.id)
], context=context)) == 1
if post.get('fields'):
record = obj.read(cr, SUPERUSER_ID, obj_ids[0], fields=post.get('fields'), context=context)
values.update(record)
return values
@http.route(['/website_mail/get_alias_info'], type='json', auth='public', website=True)
def get_alias_info(self, model, id, **post):
id = int(id)
cr, uid, context = request.cr, request.uid, request.context
obj = request.registry.get(model)
values = {'alias_name': False}
if not obj:
return values
obj_ids = obj.exists(cr, SUPERUSER_ID, [id], context=context)
if obj_ids and 'alias_id' in obj._all_columns:
alias_id = obj.browse(cr, SUPERUSER_ID, obj_ids[0], context=context).alias_id
values['alias_name'] = alias_id and alias_id.alias_domain and '%s@%s' % (alias_id.alias_name, alias_id.alias_domain) or False
return values
addons/website_mail/static/src/js/website_mail.js
+20 -10
View File
@@ -12,15 +12,12 @@
openerp.jsonRpc('/website_mail/is_follower', 'call', {
model: this.$target.data('object'),
id: this.$target.data('id'),
fields: ['name', 'alias_id'],
get_alias_info: true,
}).always(function (data) {
self.is_user = data.is_user;
self.$target.find('.js_mg_email').attr('href', 'mailto:' + data.alias_id[1]);
self.$target.find('.js_mg_link').attr('href', '/groups/' + data.id);
self.toggle_subscription(data.is_follower);
self.$target.find('input.js_follow_email')
.val(data.email ? data.email : "")
.attr("disabled", data.is_follower || (data.email.length && self.is_user) ? "disabled" : false);
self.email = data.email;
self.$target.find('.js_mg_link').attr('href', '/groups/' + self.$target.data('id'));
self.toggle_subscription(data.is_follower, data.email);
self.$target.removeClass("hidden");
});
@@ -51,10 +48,11 @@
'message_is_follower': this.$target.attr("data-follow") || "off",
'email': $email.length ? $email.val() : false,
}).then(function (follow) {
self.toggle_subscription(follow);
self.toggle_subscription(follow, self.email);
});
},
toggle_subscription: function(follow) {
toggle_subscription: function(follow, email) {
var alias_done = this.get_alias_info();
if (follow) {
this.$target.find(".js_mg_follow_form").addClass("hidden");
this.$target.find(".js_mg_details").removeClass("hidden");
@@ -63,9 +61,21 @@
this.$target.find(".js_mg_follow_form").removeClass("hidden");
this.$target.find(".js_mg_details").addClass("hidden");
}
this.$target.find('input.js_follow_email').attr("disabled", follow || this.is_user ? "disabled" : false);
this.$target.find('input.js_follow_email')
.val(email ? email : "")
.attr("disabled", follow || (email.length && this.is_user) ? "disabled" : false);
this.$target.attr("data-follow", follow ? 'on' : 'off');
return $.when(alias_done);
},
get_alias_info: function() {
var self = this;
return openerp.jsonRpc('/website_mail/get_alias_info', 'call', {
model: this.$target.data('object'),
id: this.$target.data('id'),
}).then(function (data) {
self.$target.find('.js_mg_email').attr('href', 'mailto:' + data.alias_name);
});
}
});
$(document).ready(function () {