From e555855f07113fb851f3eb9649b631f9759c69fb Mon Sep 17 00:00:00 2001 From: Xavier Morel Date: Tue, 17 Jun 2014 11:29:11 +0200 Subject: [PATCH 1/5] [ADD] ability to trigger retrying rendering with an updated rendering context --- openerp/http.py | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/openerp/http.py b/openerp/http.py index 98a6556570a..44df279bdb9 100644 --- a/openerp/http.py +++ b/openerp/http.py @@ -1037,6 +1037,15 @@ mimetypes.add_type('application/font-woff', '.woff') mimetypes.add_type('application/vnd.ms-fontobject', '.eot') mimetypes.add_type('application/x-font-ttf', '.ttf') +class Retry(RuntimeError): + """ Exception raised during QWeb rendering to signal that the rendering + should be retried with the provided ``render_updates`` dict merged into + the previous rendering context + """ + def __init__(self, name, render_updates=None): + super(Retry, self).__init__(name) + self.updates = render_updates or {} + class Response(werkzeug.wrappers.Response): """ Response object passed through controller route chain. @@ -1077,7 +1086,13 @@ class Response(werkzeug.wrappers.Response): def render(self): view_obj = request.registry["ir.ui.view"] uid = self.uid or request.uid or openerp.SUPERUSER_ID - return view_obj.render(request.cr, uid, self.template, self.qcontext, context=request.context) + while True: + try: + return view_obj.render( + request.cr, uid, self.template, self.qcontext, + context=request.context) + except Retry, e: + self.qcontext.update(e.updates) def flatten(self): self.response.append(self.render()) From 63a6ba92e2c0bade494ac05910210046e695b787 Mon Sep 17 00:00:00 2001 From: Xavier Morel Date: Tue, 17 Jun 2014 12:00:50 +0200 Subject: [PATCH 2/5] [IMP] no need to compute *all* has_group calls if the first one fails --- openerp/osv/orm.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/openerp/osv/orm.py b/openerp/osv/orm.py index 1ada929482d..0a23dda61e3 100644 --- a/openerp/osv/orm.py +++ b/openerp/osv/orm.py @@ -1704,8 +1704,8 @@ class BaseModel(object): :return: True if the current user is a member of one of the given groups """ - return any([self.pool.get('res.users').has_group(cr, uid, group_ext_id) - for group_ext_id in groups.split(',')]) + return any(self.pool['res.users'].has_group(cr, uid, group_ext_id) + for group_ext_id in groups.split(',')) def _get_default_form_view(self, cr, user, context=None): """ Generates a default single-line form view using all fields From 79e10200d5cc78d39a139f63eb2a69309878ab04 Mon Sep 17 00:00:00 2001 From: Xavier Morel Date: Tue, 17 Jun 2014 12:01:52 +0200 Subject: [PATCH 3/5] [IMP] prevent edition of page if groups which current user doesn't have If the current view uses @groups attributes (possibly in called templates), the corresponding elements are rendered to a void (empty string in qweb). If said user can edit the page, does so and saves a view section in which there's a @groups to which he has no access, the element[@groups] is completely removed from the template once saved, losing it. If QWeb encounters an @groups to which the current user has no right during rendering, have it request a no-RTE page, so the user can not RTE-edit the page (or drop snippets in it). --- addons/website/static/src/js/website.editor.js | 12 ++++++++++++ addons/website/static/src/xml/website.xml | 3 ++- addons/website/views/website_templates.xml | 7 +++++-- openerp/addons/base/ir/ir_qweb.py | 14 ++++++++++---- 4 files changed, 29 insertions(+), 7 deletions(-) diff --git a/addons/website/static/src/js/website.editor.js b/addons/website/static/src/js/website.editor.js index fcb957cafda..f8d1a66bc80 100644 --- a/addons/website/static/src/js/website.editor.js +++ b/addons/website/static/src/js/website.editor.js @@ -3,6 +3,7 @@ var website = openerp.website; var _t = openerp._t; + website.no_editor = !!$(document.documentElement).data('editable-no-editor'); website.add_template_file('/website/static/src/xml/website.editor.xml'); website.dom_ready.done(function () { @@ -496,6 +497,17 @@ this.$('#website-top-edit').hide(); this.$('#website-top-view').show(); + if (website.no_editor) { + var help_text = $(document.documentElement).data('editable-no-editor'); + this.$('button[data-action=edit]') + .prop('disabled', website.no_editor) + .parent() + // help must be set on form above button because it does + // not appear on disabled button + .attr('title', help_text); + } + + $('.dropdown-toggle').dropdown(); this.customize_setup(); diff --git a/addons/website/static/src/xml/website.xml b/addons/website/static/src/xml/website.xml index 4d9c9fcd73d..684a46a9f43 100644 --- a/addons/website/static/src/xml/website.xml +++ b/addons/website/static/src/xml/website.xml @@ -14,7 +14,8 @@
- +
diff --git a/addons/website/views/website_templates.xml b/addons/website/views/website_templates.xml index e5c1bfc0f86..50d4fa8b906 100644 --- a/addons/website/views/website_templates.xml +++ b/addons/website/views/website_templates.xml @@ -59,6 +59,7 @@