From 4c88701f3dbf12414540db95d98b18ab628ff142 Mon Sep 17 00:00:00 2001 From: Xavier Morel Date: Fri, 25 Oct 2013 11:59:52 +0200 Subject: [PATCH 1/2] [FIX] change access rights for customize_template_* bzr revid: xmo@openerp.com-20131025095952-9ditm4q3fwr9auto --- addons/website/controllers/main.py | 4 ++-- addons/website/static/src/js/website.editor.js | 1 - 2 files changed, 2 insertions(+), 3 deletions(-) diff --git a/addons/website/controllers/main.py b/addons/website/controllers/main.py index 417fca99b27..2f49071adf6 100644 --- a/addons/website/controllers/main.py +++ b/addons/website/controllers/main.py @@ -130,7 +130,7 @@ class Website(openerp.addons.web.controllers.main.Home): html = request.website.render('website.404', values) return html - @website.route('/website/customize_template_toggle', type='json', auth='admin') # FIXME: auth + @website.route('/website/customize_template_toggle', type='json', auth='user') def customize_template_set(self, view_id): view_obj = request.registry.get("ir.ui.view") view = view_obj.browse(request.cr, request.uid, int(view_id), @@ -144,7 +144,7 @@ class Website(openerp.addons.web.controllers.main.Home): }, context=request.context) return True - @website.route('/website/customize_template_get', type='json', auth='admin') # FIXME: auth + @website.route('/website/customize_template_get', type='json', auth='user') def customize_template_get(self, xml_id, optional=True): imd = request.registry['ir.model.data'] view_model, view_theme_id = imd.get_object_reference( diff --git a/addons/website/static/src/js/website.editor.js b/addons/website/static/src/js/website.editor.js index f9d2aef339b..6fb0f459a22 100644 --- a/addons/website/static/src/js/website.editor.js +++ b/addons/website/static/src/js/website.editor.js @@ -517,7 +517,6 @@ fetch_editables: function (root) { return $(root).find('[data-oe-model]') - // FIXME: propagation should make "meta" blocks non-editable in the first place... .not('link, script') .not('.oe_snippet_editor') .filter(function () { From 77e79435d08a1a83bf8c2fad8216773304bafadb Mon Sep 17 00:00:00 2001 From: Xavier Morel Date: Fri, 25 Oct 2013 12:24:21 +0200 Subject: [PATCH 2/2] [ADD] blog.tag access rights so public user can read blog Issue was no access rights on blog.tag, add ability for all users to read them, and for "knowledge" users to edit them. Also fix pre-existing access rights and move them to knowledge users, not users in general. bzr revid: xmo@openerp.com-20131025102421-0c86z775nedzgqyi --- addons/website_blog/security/ir.model.access.csv | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/addons/website_blog/security/ir.model.access.csv b/addons/website_blog/security/ir.model.access.csv index bfaef7af5f8..13dbed9967c 100644 --- a/addons/website_blog/security/ir.model.access.csv +++ b/addons/website_blog/security/ir.model.access.csv @@ -1,5 +1,7 @@ id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink blog_category_all,blog.category,model_blog_category,,1,0,0,0 blog_post_all,blog.post,model_blog_post,,1,0,0,0 -blog_post,blog.post,model_blog_post,base.group_user,1,1,1,1 -blog_post_history,blog.post.history,model_blog_post_history,base.group_user,1,0,1,0 +blog_post,blog.post,model_blog_post,base.group_document_user,1,1,1,1 +blog_post_history,blog.post.history,model_blog_post_history,base.group_document_user,1,0,1,0 +blog_tag,blog.tag,model_blog_tag,,1,0,0,0 +blog_tag_edition,blog.tag,model_blog_tag,base.group_document_user,1,1,1,1