[FIX] website/ir_rule: Access rights can be cached if they use the html session: remove session from access right evaluation, allow to read pricelist to evrybody and use superuser for saleorder in website_sale

bzr revid: chm@openerp.com-20140107095210-73zf5ah4jrfo3dg2

addons/website/models/__init__.py

@@ -2,7 +2,6 @@
 
 import ir_ui_view
 import website
-import ir_rule
 import ir_qweb
 import ir_http
 

addons/website/models/ir_rule.py

@@ -1,25 +0,0 @@
-# -*- coding: utf-8 -*-
-
-from openerp.osv import osv
-from openerp.addons.web.http import request
-from openerp.tools.misc import unquote as unquote
-
-
-class ir_rule(osv.osv):
-    _inherit = 'ir.rule'
-
-    def _eval_context_for_combinations(self):
-        """Returns a dictionary to use as evaluation context for
-           ir.rule domains, when the goal is to obtain python lists
-           that are easier to parse and combine, but not to
-           actually execute them."""
-        res = super(ir_rule, self)._eval_context_for_combinations()
-        res.update(session=unquote('session'))
-        return res
-
-    def _eval_context(self, cr, uid):
-        """Returns a dictionary to use as evaluation context for
-           ir.rule domains."""
-        res = super(ir_rule, self)._eval_context(cr, uid)
-        res.update(session=request and request.httprequest and request.httprequest.session)
-        return res

addons/website_sale/models/website.py

@@ -13,7 +13,7 @@ class Website(orm.Model):
         pricelist_id = self.ecommerce_get_pricelist_id(cr, uid, ids, context=context)
         return dict.fromkeys(
             ids, self.pool['product.pricelist'].browse(
-                cr, uid, pricelist_id, context=context))
+                cr, SUPERUSER_ID, pricelist_id, context=context))
 
     _columns = {
         'pricelist_id': fields.function(
@@ -99,8 +99,8 @@ class Website(orm.Model):
             request.httprequest.session['ecommerce_order_id'] = False
             return False
         try:
-            #SaleOrder.check_access_rule(cr, uid, order_id, context=context)
-            order = SaleOrder.browse(cr, uid, order_id, context=context)
+            order = SaleOrder.browse(cr, SUPERUSER_ID, order_id, context=context)
+            assert order.website_session_id == request.httprequest.session['website_session_id']
             return order
         except:
             request.httprequest.session['ecommerce_order_id'] = False

addons/website_sale/security/ir.model.access.csv

@@ -7,8 +7,6 @@ access_product_pricelist_version_public,product.pricelist.version.public,product
 access_product_pricelist_public,product.pricelist.public,product.model_product_pricelist,base.group_public,1,0,0,0
 access_product_pricelist_item_public,product.pricelist.item.public,product.model_product_pricelist_item,base.group_public,1,0,0,0
 access_product_product_price_type_public,product.price.type.public,product.model_product_price_type,base.group_public,1,0,0,0
-access_sale_order_public,sale.order.public,model_sale_order,base.group_public,1,0,0,0
-access_sale_order_line_public,sale.order.line.public,model_sale_order_line,base.group_public,1,0,0,0
 access_product_attribute,product.attribute.public,website_sale.model_product_attribute,,1,0,0,0
 access_product_attribute_value,product.attribute.value.public,website_sale.model_product_attribute_value,,1,0,0,0
 access_product_attribute_product,product.attribute.product.public,website_sale.model_product_attribute_product,,1,0,0,0

addons/website_sale/security/website_sale.xml

@@ -11,38 +11,6 @@
         <field name="perm_create" eval="False"/>
         <field name="perm_unlink" eval="False"/>
     </record>
-
-    <record id="sale_order_personal_rule_public" model="ir.rule">
-        <field name="name">Public Personal Orders</field>
-        <field ref="model_sale_order" name="model_id"/>
-        <field name="domain_force">[('state','=','draft'), ('website_session_id','!=',False), ('website_session_id','=',session.get('website_session_id'))]</field>
-        <field name="groups" eval="[(4, ref('base.group_public')), (4, ref('base.group_portal'))]"/>
-        <field name="perm_read" eval="True"/>
-        <field name="perm_write" eval="False"/>
-        <field name="perm_create" eval="False"/>
-        <field name="perm_unlink" eval="False"/>
-    </record>
-    <record id="sale_order_lines_personal_rule_public" model="ir.rule">
-        <field name="name">Public Personal Order lines</field>
-        <field ref="model_sale_order_line" name="model_id"/>
-        <field name="domain_force">[('state','=','draft'), ('order_id.website_session_id','!=',False), ('order_id.website_session_id','=',session.get('website_session_id'))]</field>
-        <field name="groups" eval="[(4, ref('base.group_public')), (4, ref('base.group_portal'))]"/>
-        <field name="perm_read" eval="True"/>
-        <field name="perm_write" eval="False"/>
-        <field name="perm_create" eval="False"/>
-        <field name="perm_unlink" eval="False"/>
-    </record>
-
-    <record id="product_pricelist_public" model="ir.rule">
-        <field name="name">Public product pricelist</field>
-        <field name="model_id" ref="product.model_product_pricelist"/>
-        <field name="domain_force">[('id','=',session.get('ecommerce_pricelist'))]</field>
-        <field name="groups" eval="[(4, ref('base.group_public')), (4, ref('base.group_portal'))]"/>
-        <field name="perm_read" eval="True"/>
-        <field name="perm_write" eval="False"/>
-        <field name="perm_create" eval="False"/>
-        <field name="perm_unlink" eval="False"/>
-    </record>
     
     <record id="product_supplierinfo_public" model="ir.rule">
         <field name="name">Public product supplierinfo</field>