From 20b6367ec59ea0087a0282fbd691fc7b24d8cb8e Mon Sep 17 00:00:00 2001 From: Christophe Matthieu Date: Tue, 8 Oct 2013 17:22:33 +0200 Subject: [PATCH] [IMP] website_sale: better access rules and security bzr revid: chm@openerp.com-20131008152233-zl3dxoyso9liahlm --- addons/website/models/website.py | 2 +- addons/website_sale/controllers/main.py | 54 ++++++++++++------- .../website_sale/security/ir.model.access.csv | 8 +-- addons/website_sale/security/website_sale.xml | 25 ++++++++- addons/website_sale/website_sale.py | 7 ++- 5 files changed, 68 insertions(+), 28 deletions(-) diff --git a/addons/website/models/website.py b/addons/website/models/website.py index 90957b584a4..26421f2af6d 100644 --- a/addons/website/models/website.py +++ b/addons/website/models/website.py @@ -147,7 +147,7 @@ class website(osv.osv): website=request.website, url_for=url_for, res_company=request.website.company_id, - user_id=user.browse(cr, openerp.SUPERUSER_ID, uid), + user_id=user.browse(cr, uid, uid), ) context = request.context.copy() diff --git a/addons/website_sale/controllers/main.py b/addons/website_sale/controllers/main.py index e6726761b3e..2144df4dd51 100644 --- a/addons/website_sale/controllers/main.py +++ b/addons/website_sale/controllers/main.py @@ -6,33 +6,45 @@ from openerp.addons.web import http from openerp.addons.web.http import request from openerp.addons.website.models import website import random +import uuid def get_order(order_id=None): order_obj = request.registry.get('sale.order') - # check if order allready exists + # check if order allready exists and have access if order_id: try: - order = order_obj.browse(request.cr, SUPERUSER_ID, order_id, context=request.context) + order = order_obj.browse(request.cr, request.uid, order_id, context=request.context) order.pricelist_id + if order: + return order except: - order_id = None - if not order_id: - fields = [k for k, v in order_obj._columns.items()] - order_value = order_obj.default_get(request.cr, SUPERUSER_ID, fields, context=request.context) - if request.httprequest.session.get('ecommerce_pricelist'): - order_value['pricelist_id'] = request.httprequest.session['ecommerce_pricelist'] - order_value['partner_id'] = request.registry.get('res.users').browse(request.cr, SUPERUSER_ID, request.uid, context=request.context).partner_id.id - order_value.update(order_obj.onchange_partner_id(request.cr, SUPERUSER_ID, [], order_value['partner_id'], context=request.context)['value']) - order_id = order_obj.create(request.cr, SUPERUSER_ID, order_value, context=request.context) - order = order_obj.browse(request.cr, SUPERUSER_ID, order_id, context=request.context) - request.httprequest.session['ecommerce_order_id'] = order.id + return False - return order_obj.browse(request.cr, SUPERUSER_ID, order_id, + fields = [k for k, v in order_obj._columns.items()] + order_value = order_obj.default_get(request.cr, SUPERUSER_ID, fields, context=request.context) + if request.httprequest.session.get('ecommerce_pricelist'): + order_value['pricelist_id'] = request.httprequest.session['ecommerce_pricelist'] + order_value['partner_id'] = request.registry.get('res.users').browse(request.cr, SUPERUSER_ID, request.uid, context=request.context).partner_id.id + order_value.update(order_obj.onchange_partner_id(request.cr, SUPERUSER_ID, [], order_value['partner_id'], context=request.context)['value']) + + # add website_session_id key for access rules + if not request.httprequest.session.get('website_session_id'): + request.httprequest.session['website_session_id'] = str(uuid.uuid4()) + + order_value["website_session_id"] = request.httprequest.session['website_session_id'] + order_id = order_obj.create(request.cr, SUPERUSER_ID, order_value, context=request.context) + order = order_obj.browse(request.cr, SUPERUSER_ID, order_id, context=request.context) + request.httprequest.session['ecommerce_order_id'] = order.id + + return order_obj.browse(request.cr, request.uid, order_id, context=dict(request.context, pricelist=order.pricelist_id.id)) def get_current_order(): if request.httprequest.session.get('ecommerce_order_id'): - return get_order(request.httprequest.session.get('ecommerce_order_id')) + order = get_order(request.httprequest.session.get('ecommerce_order_id')) + if not order: + request.httprequest.session['ecommerce_order_id'] = False + return order else: return False @@ -317,6 +329,7 @@ class Ecommerce(http.Controller): def add_product_to_cart(self, product_id=0, order_line_id=0, number=1, set_number=-1): order_line_obj = request.registry.get('sale.order.line') + order_obj = request.registry.get('sale.order') order = get_current_order() if not order: @@ -364,9 +377,8 @@ class Ecommerce(http.Controller): if not quantity: order_line_obj.unlink(request.cr, SUPERUSER_ID, order_line_ids, context=request.context) else: - #values['name'] = "website order" order_line_id = order_line_obj.create(request.cr, SUPERUSER_ID, values, context=request.context) - order.write({'order_line': [(4, order_line_id)]}, context=request.context) + order_obj.write(request.cr, SUPERUSER_ID, [order.id], {'order_line': [(4, order_line_id)]}, context=request.context) return [quantity, order.get_total_quantity()] @@ -500,10 +512,11 @@ class Ecommerce(http.Controller): 'state_id': post['state_id'], } if not request.context['is_public_user']: - partner_id = user_obj.browse(request.cr, request.uid, request.uid, request.context).partner_id.id - partner_obj.write(request.cr, request.uid, [partner_id], partner_value, request.context) + partner_id = user_obj.browse(request.cr, request.uid, request.uid, context=request.context).partner_id.id + partner_obj.write(request.cr, request.uid, [partner_id], partner_value, context=request.context) else: - partner_id = partner_obj.create(request.cr, SUPERUSER_ID, partner_value, request.context) + partner_id = partner_obj.create(request.cr, SUPERUSER_ID, partner_value, context=request.context) + shipping_id = None if post.get('shipping_different'): @@ -530,6 +543,7 @@ class Ecommerce(http.Controller): order_value = { 'partner_id': partner_id, + 'message_follower_ids': [(4, partner_id)], 'partner_invoice_id': partner_id, 'partner_shipping_id': shipping_id or partner_id } diff --git a/addons/website_sale/security/ir.model.access.csv b/addons/website_sale/security/ir.model.access.csv index 21fc3dcb98d..3c682ada36f 100644 --- a/addons/website_sale/security/ir.model.access.csv +++ b/addons/website_sale/security/ir.model.access.csv @@ -1,7 +1,9 @@ id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink access_product_product_public,product.product.public,product.model_product_product,base.group_public,1,0,0,0 access_product_template_public,product.template.public,product.model_product_template,base.group_public,1,0,0,0 -access_product_category_,product.category,product.model_product_category,base.group_public,1,0,0,0 +access_product_category_,product.category.public,product.model_product_category,base.group_public,1,0,0,0 access_product_category_public,product.category.public,product.model_product_public_category,base.group_public,1,0,0,0 -access_product_pricelist_version_public,product.pricelist.version,product.model_product_pricelist_version,base.group_public,1,0,0,0 -access_product_product_price_type_public,product.price.type,product.model_product_price_type,base.group_public,1,0,0,0 \ No newline at end of file +access_product_pricelist_version_public,product.pricelist.version.public,product.model_product_pricelist_version,base.group_public,1,0,0,0 +access_product_product_price_type_public,product.price.type.public,product.model_product_price_type,base.group_public,1,0,0,0 +access_sale_order_public,sale.order.public,model_sale_order,base.group_public,1,0,0,0 +access_sale_order_line_public,sale.order.line.public,model_sale_order_line,base.group_public,1,0,0,0 \ No newline at end of file diff --git a/addons/website_sale/security/website_sale.xml b/addons/website_sale/security/website_sale.xml index 3b3489ac77c..71b4e5f7787 100644 --- a/addons/website_sale/security/website_sale.xml +++ b/addons/website_sale/security/website_sale.xml @@ -2,7 +2,7 @@ - product: Public product template + Public product template [('website_published', '=', True), ("sale_ok", "=", True)] @@ -12,7 +12,7 @@ - product: Public product + Public product [('website_published', '=', True), ("sale_ok", "=", True)] @@ -21,5 +21,26 @@ + + + Public Personal Orders + + [('state','=','draft'), ('website_session_id','!=',False), ('website_session_id','!=',session.get('website_session_id'))] + + + + + + + + Public Personal Order lines + + [('state','=','draft'), ('order_id.website_session_id','!=',False), ('order_id.website_session_id','!=',session.get('website_session_id'))] + + + + + + diff --git a/addons/website_sale/website_sale.py b/addons/website_sale/website_sale.py index 3e3e2888474..8d5404810aa 100644 --- a/addons/website_sale/website_sale.py +++ b/addons/website_sale/website_sale.py @@ -20,12 +20,15 @@ ############################################################################## from openerp import SUPERUSER_ID -from openerp.osv import osv - +from openerp.osv import osv, fields class sale_order(osv.Model): _inherit = "sale.order" + _columns = { + 'website_session_id': fields.char('Session UUID4'), + } + def get_total_quantity(self, cr, uid, ids, context=None): order = self.browse(cr, uid, ids[0], context=context) return int(sum(l.product_uom_qty for l in (order.order_line or [])))