From 1e54a8f6ab9a2f1f80f0bccfbd98eec90f818a07 Mon Sep 17 00:00:00 2001 From: Jeremy Kersten Date: Wed, 3 Feb 2016 17:43:08 +0100 Subject: [PATCH] [FIX] website_forum: don't index forum_post if deleted update can view, to remove deleted post from sitemap and make controller unavailable for lambda user. Only Admin, and users with enough karams can continue to see them and undelete them. --- addons/website_forum/models/forum.py | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/addons/website_forum/models/forum.py b/addons/website_forum/models/forum.py index 6eadc479559..6bc26b35efa 100644 --- a/addons/website_forum/models/forum.py +++ b/addons/website_forum/models/forum.py @@ -289,15 +289,18 @@ class Post(models.Model): LEFT JOIN res_users u ON p.create_uid = u.id LEFT JOIN forum_forum f ON p.forum_id = f.id WHERE - u.karma > 0 - or (p.create_uid = %s and f.karma_close_own <= %s) + (p.create_uid = %s and f.karma_close_own <= %s) or (p.create_uid != %s and f.karma_close_all <= %s) + or ( + u.karma > 0 + and (p.active or p.create_uid = %s) + ) """ op = operator == "=" and "inselect" or "not inselect" # don't use param named because orm will add other param (test_active, ...) - return [('id', op, (req, (user.id, user.karma, user.id, user.karma)))] + return [('id', op, (req, (user.id, user.karma, user.id, user.karma, user.id)))] @api.one @api.depends('content') @@ -390,7 +393,7 @@ class Post(models.Model): post.can_downvote = is_admin or user.karma >= post.forum_id.karma_downvote post.can_comment = is_admin or user.karma >= post.karma_comment post.can_comment_convert = is_admin or user.karma >= post.karma_comment_convert - post.can_view = is_admin or user.karma >= post.karma_close or post_sudo.create_uid.karma > 0 + post.can_view = is_admin or user.karma >= post.karma_close or (post_sudo.create_uid.karma > 0 and (post_sudo.active or post_sudo.create_uid.id == user)) post.can_display_biography = is_admin or post_sudo.create_uid.karma >= post.forum_id.karma_user_bio post.can_post = is_admin or user.karma >= post.forum_id.karma_post post.can_flag = is_admin or user.karma >= post.forum_id.karma_flag