From 259e7784049d4ff6bb9dfc0cd2bff6abe36739e2 Mon Sep 17 00:00:00 2001 From: Damien Bouvy Date: Mon, 25 Jul 2016 13:56:50 +0200 Subject: [PATCH] [IMP] website_portal: whitelist values in submitted in post --- addons/website_portal/controllers/main.py | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/addons/website_portal/controllers/main.py b/addons/website_portal/controllers/main.py index 1b4464ac331..2d09e5538d4 100644 --- a/addons/website_portal/controllers/main.py +++ b/addons/website_portal/controllers/main.py @@ -11,6 +11,9 @@ from odoo.fields import Date class website_account(http.Controller): + MANDATORY_BILLING_FIELDS = ["name", "phone", "email", "street2", "city", "country_id"] + OPTIONAL_BILLING_FIELDS = ["zipcode", "state_id", "vat", "street"] + _items_per_page = 10 def _prepare_portal_layout_values(self): @@ -65,8 +68,9 @@ class website_account(http.Controller): values.update({'error': error, 'error_message': error_message}) values.update(post) if not error: - post.update({'zip': post.pop('zipcode', '')}) - partner.sudo().write(post) + values = {key: post[key] for key in self.MANDATORY_BILLING_FIELDS + self.OPTIONAL_BILLING_FIELDS} + values.update({'zip': post.pop('zipcode', '')}) + partner.sudo().write(values) if redirect: return request.redirect(redirect) return request.redirect('/my/home') @@ -88,11 +92,8 @@ class website_account(http.Controller): error = dict() error_message = [] - mandatory_billing_fields = ["name", "phone", "email", "street2", "city", "country_id"] - optional_billing_fields = ["zipcode", "state_id", "vat", "street"] - # Validation - for field_name in mandatory_billing_fields: + for field_name in self.MANDATORY_BILLING_FIELDS: if not data.get(field_name): error[field_name] = 'missing' @@ -112,11 +113,12 @@ class website_account(http.Controller): vat_country, vat_number = request.env["res.partner"]._split_vat(data.get("vat")) if not check_func(vat_country, vat_number): # simple_vat_check error["vat"] = 'error' + # error message for empty required fields if [err for err in error.values() if err == 'missing']: error_message.append(_('Some required fields are empty.')) - unknown = [k for k in data.iterkeys() if k not in mandatory_billing_fields + optional_billing_fields] + unknown = [k for k in data.iterkeys() if k not in self.MANDATORY_BILLING_FIELDS + self.OPTIONAL_BILLING_FIELDS] if unknown: error['common'] = 'Unknown field' error_message.append("Unknown field '%s'" % ','.join(unknown))