From 9fd7db5150dfd7f50476f3d9a5a1dcf1afff239b Mon Sep 17 00:00:00 2001 From: Christophe Matthieu Date: Tue, 7 Jan 2014 09:57:28 +0100 Subject: [PATCH] [WIP] website/ir_rule: remove session from access right evaluation, allow to read pricelist to evrybody and use superuser for saleorder in website_sale bzr revid: chm@openerp.com-20140107085728-77mxlims6fa0li76 --- addons/website/models/__init__.py | 1 - addons/website/models/ir_rule.py | 25 --------------- addons/website_sale/models/website.py | 6 ++-- .../website_sale/security/ir.model.access.csv | 2 -- addons/website_sale/security/website_sale.xml | 32 ------------------- 5 files changed, 3 insertions(+), 63 deletions(-) delete mode 100644 addons/website/models/ir_rule.py diff --git a/addons/website/models/__init__.py b/addons/website/models/__init__.py index 9e5fd3bea71..7b1fb060003 100644 --- a/addons/website/models/__init__.py +++ b/addons/website/models/__init__.py @@ -2,7 +2,6 @@ import ir_ui_view import website -import ir_rule import ir_qweb import ir_http diff --git a/addons/website/models/ir_rule.py b/addons/website/models/ir_rule.py deleted file mode 100644 index dcb56795173..00000000000 --- a/addons/website/models/ir_rule.py +++ /dev/null @@ -1,25 +0,0 @@ -# -*- coding: utf-8 -*- - -from openerp.osv import osv -from openerp.addons.web.http import request -from openerp.tools.misc import unquote as unquote - - -class ir_rule(osv.osv): - _inherit = 'ir.rule' - - def _eval_context_for_combinations(self): - """Returns a dictionary to use as evaluation context for - ir.rule domains, when the goal is to obtain python lists - that are easier to parse and combine, but not to - actually execute them.""" - res = super(ir_rule, self)._eval_context_for_combinations() - res.update(session=unquote('session')) - return res - - def _eval_context(self, cr, uid): - """Returns a dictionary to use as evaluation context for - ir.rule domains.""" - res = super(ir_rule, self)._eval_context(cr, uid) - res.update(session=request and request.httprequest and request.httprequest.session) - return res diff --git a/addons/website_sale/models/website.py b/addons/website_sale/models/website.py index 384bb452a50..ace4adc7dd4 100644 --- a/addons/website_sale/models/website.py +++ b/addons/website_sale/models/website.py @@ -13,7 +13,7 @@ class Website(orm.Model): pricelist_id = self.ecommerce_get_pricelist_id(cr, uid, ids, context=context) return dict.fromkeys( ids, self.pool['product.pricelist'].browse( - cr, uid, pricelist_id, context=context)) + cr, SUPERUSER_ID, pricelist_id, context=context)) _columns = { 'pricelist_id': fields.function( @@ -99,8 +99,8 @@ class Website(orm.Model): request.httprequest.session['ecommerce_order_id'] = False return False try: - #SaleOrder.check_access_rule(cr, uid, order_id, context=context) - order = SaleOrder.browse(cr, uid, order_id, context=context) + order = SaleOrder.browse(cr, SUPERUSER_ID, order_id, context=context) + assert order.website_session_id == request.httprequest.session['website_session_id'] return order except: request.httprequest.session['ecommerce_order_id'] = False diff --git a/addons/website_sale/security/ir.model.access.csv b/addons/website_sale/security/ir.model.access.csv index dc2e11eca6c..a64fc2cde73 100644 --- a/addons/website_sale/security/ir.model.access.csv +++ b/addons/website_sale/security/ir.model.access.csv @@ -7,8 +7,6 @@ access_product_pricelist_version_public,product.pricelist.version.public,product access_product_pricelist_public,product.pricelist.public,product.model_product_pricelist,base.group_public,1,0,0,0 access_product_pricelist_item_public,product.pricelist.item.public,product.model_product_pricelist_item,base.group_public,1,0,0,0 access_product_product_price_type_public,product.price.type.public,product.model_product_price_type,base.group_public,1,0,0,0 -access_sale_order_public,sale.order.public,model_sale_order,base.group_public,1,0,0,0 -access_sale_order_line_public,sale.order.line.public,model_sale_order_line,base.group_public,1,0,0,0 access_product_attribute,product.attribute.public,website_sale.model_product_attribute,,1,0,0,0 access_product_attribute_value,product.attribute.value.public,website_sale.model_product_attribute_value,,1,0,0,0 access_product_attribute_product,product.attribute.product.public,website_sale.model_product_attribute_product,,1,0,0,0 diff --git a/addons/website_sale/security/website_sale.xml b/addons/website_sale/security/website_sale.xml index 94b039d02be..0481c27f8af 100644 --- a/addons/website_sale/security/website_sale.xml +++ b/addons/website_sale/security/website_sale.xml @@ -11,38 +11,6 @@ - - - Public Personal Orders - - [('state','=','draft'), ('website_session_id','!=',False), ('website_session_id','=',session.get('website_session_id'))] - - - - - - - - Public Personal Order lines - - [('state','=','draft'), ('order_id.website_session_id','!=',False), ('order_id.website_session_id','=',session.get('website_session_id'))] - - - - - - - - - Public product pricelist - - [('id','=',session.get('ecommerce_pricelist'))] - - - - - - Public product supplierinfo