pengyuthon/odoo_source
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[IMP] website: remove employee visibility level

Browse Source 
You can use has_group(employee) instead

+ fix enumerate_page: when you search a page with visibility constraints,
you never seen it even if force was set to True.

task-2091365 again

closes odoo/odoo#41483

X-original-commit: f1c7a34f0b8276895c18ca6c450a142f9a815e3b
Signed-off-by: Jérémy Kersten (jke) <jke@openerp.com>
This commit is contained in:
Jeremy Kersten
2019-12-06 09:48:05 +00:00
parent 2178ad9671
commit 361b711ffc
5 changed files with 45 additions and 38 deletions
Download Patch File Download Diff File Expand all files Collapse all files
addons/website/models/ir_ui_view.py
+13 -14
View File
@@ -4,9 +4,8 @@
import logging
import werkzeug
import uuid
from itertools import groupby
from odoo import api, fields, models, _
from odoo import api, fields, models
from odoo import tools
from odoo.addons.http_routing.models.ir_http import url_for
from odoo.osv import expression
@@ -25,9 +24,9 @@ class View(models.Model):
page_ids = fields.One2many('website.page', 'view_id')
first_page_id = fields.Many2one('website.page', string='Website Page', help='First page linked to this view', compute='_compute_first_page_id')
track = fields.Boolean(string='Track', default=False, help="Allow to specify for one page of the website to be trackable or not")
visibility = fields.Selection([('', 'All'), ('connected', 'Connected'), ('restricted_group', 'Restricted Group'), ('password', 'With Password'), ('employee', 'Internal Users')], default='')
visibility = fields.Selection([('', 'All'), ('connected', 'Signed In'), ('restricted_group', 'Restricted Group'), ('password', 'With Password')], default='')
visibility_group = fields.Many2one('res.groups')
visibility_password = fields.Char(groups='base.group_system')
visibility_password = fields.Char(groups='website.group_website_publisher')
def _compute_first_page_id(self):
for view in self:
@@ -314,22 +313,22 @@ class View(models.Model):
def handle_visibility(self, do_raise=True):
""" Check the visibility set on the main view and raise 403 if you should not have access.
Order is: Public, Connected, Has group, Password, Employee
An user type can see all previous type. So an employee can see password page withtout
know the password.
Order is: Public, Connected, Has group, Password
It only check the visibility on the main content, others views called stay available in
rpc or via other way.
It only check the visibility on the main content, others views called stay available in rpc.
"""
error = False
self = self.sudo()
if self.visibility and not request.env.user.has_group('website.group_website_designer'):
if (self.visibility == 'connected' and request.website.is_public_user()) or \
(self.visibility == 'employee' and request.env.user.share) or \
(self.visibility == 'restricted_group' and request.env.user.share and self.visibility_group and
request.env.user.id not in self.visibility_group.sudo().users.ids):
if (self.visibility == 'connected' and request.website.is_public_user()):
error = werkzeug.exceptions.Forbidden()
elif self.visibility == 'password' and request.env.user.share and (request.website.is_public_user() or self.id not in request.session.get('views_unlock', [])):
elif self.visibility == 'restricted_group' and self.visibility_group:
# special case, to avoid employee.user_ids
if (self.visibility_group.get_external_id() == 'base.group_user' and not request.env.user.share) or \
request.env.user.id not in self.visibility_group.sudo().users.ids:
error = werkzeug.exceptions.Forbidden()
elif self.visibility == 'password' and \
(request.website.is_public_user() or self.id not in request.session.get('views_unlock', [])):
if self.sudo().visibility_password == request.params.get('visibility_password'):
request.session.setdefault('views_unlock', list()).append(self.id)
else:
addons/website/models/website.py
+6 -3
View File
@@ -769,11 +769,14 @@ class Website(models.Model):
yield page
# '/' already has a http.route & is in the routing_map so it will already have an entry in the xml
domain = [('url', '!=', '/'), ('visibility', '=', False)]
domain = [('url', '!=', '/')]
if not force:
domain += [('website_indexed', '=', True)]
domain += [('website_indexed', '=', True), ('visibility', '=', False)]
# is_visible
domain += [('website_published', '=', True), '|', ('date_publish', '=', False), ('date_publish', '<=', fields.Datetime.now())]
domain += [
('website_published', '=', True), ('visibility', '=', False),
'|', ('date_publish', '=', False), ('date_publish', '<=', fields.Datetime.now())
]
if query_string:
domain += [('url', 'like', query_string)]
addons/website/models/website_page.py
+10
View File
@@ -62,6 +62,16 @@ class Page(models.Model):
""" Get identifier of this page view that may be used to render it """
return self.view_id.id
def get_page_properties(self):
self.ensure_one()
res = self.read([
'id', 'name', 'url', 'website_published', 'website_indexed', 'date_publish',
'menu_ids', 'is_homepage', 'website_id', 'visibility', 'visibility_password', 'visibility_group'
])[0]
if not res['visibility_group']:
res['visibility_group'] = self.env.ref('base.group_user').name_get()[0]
return res
@api.model
def save_page_info(self, website_id, data):
website = self.env['website'].browse(website_id)
addons/website/static/src/js/menu/content.js
+14 -18
View File
@@ -79,15 +79,11 @@ var PagePropertiesDialog = weWidgets.Dialog.extend({
defs.push(this._rpc({
model: 'website.page',
method: 'read',
args: [
this.page_id,
['id', 'name', 'url', 'website_published', 'website_indexed', 'date_publish',
'menu_ids', 'is_homepage', 'website_id', 'visibility', 'visibility_password', 'visibility_group']
],
method: 'get_page_properties',
args: [this.page_id],
}).then(function (page) {
page[0].url = _.str.startsWith(page[0].url, '/') ? page[0].url.substring(1) : page[0].url;
self.page = page[0];
page.url = _.str.startsWith(page.url, '/') ? page.url.substring(1) : page.url;
self.page = page;
}));
return Promise.all(defs);
@@ -206,13 +202,13 @@ var PagePropertiesDialog = weWidgets.Dialog.extend({
});
var url = this.$('#page_url').val();
var $date_publish = this.$("#date_publish");
$date_publish.closest(".form-group").removeClass('o_has_error').find('.form-control, .custom-select').removeClass('is-invalid');
var date_publish = $date_publish.val();
if (date_publish !== "") {
date_publish = this._parse_date(date_publish);
if (!date_publish) {
$date_publish.closest(".form-group").addClass('o_has_error').find('.form-control, .custom-select').addClass('is-invalid');
var $datePublish = this.$("#date_publish");
$datePublish.closest(".form-group").removeClass('o_has_error').find('.form-control, .custom-select').removeClass('is-invalid');
var datePublish = $datePublish.val();
if (datePublish !== "") {
datePublish = this._parse_date(datePublish);
if (!datePublish) {
$datePublish.closest(".form-group").addClass('o_has_error').find('.form-control, .custom-select').addClass('is-invalid');
return;
}
}
@@ -228,9 +224,9 @@ var PagePropertiesDialog = weWidgets.Dialog.extend({
redirect_type: this.$('#redirect_type').val(),
website_indexed: this.$('#is_indexed').prop('checked'),
visibility: this.$('#visibility').val(),
visibility_password: this.$('#visibility_password').val(),
visibility_group: this.$('#visibility_group').data('group-id'),
date_publish: date_publish,
visibility_password: this.$('#visibility').val() === 'password' ? this.$('#visibility_password').val() : false,
visibility_group: this.$('#visibility').val() === 'restricted_group' ? this.$('#visibility_group').data('group-id') : false,
date_publish: datePublish,
};
this._rpc({
model: 'website.page',
addons/website/static/src/xml/website.pageProperties.xml
+2 -3
View File
@@ -145,10 +145,9 @@
<div class="input-group">
<select id="visibility" class="form-control col-md-4">
<option value="" t-att-selected="widget.page.visibility == ''">Public</option>
<option value="connected" t-att-selected="widget.page.visibility == 'connected' ? 'selected' : undefined">Connected</option>
<option value="restricted_group" t-att-selected="widget.page.visibility == 'restricted_group' ? 'selected' : undefined">Has Group</option>
<option value="connected" t-att-selected="widget.page.visibility == 'connected' ? 'selected' : undefined">Signed In</option>
<option value="restricted_group" t-att-selected="widget.page.visibility == 'restricted_group' ? 'selected' : undefined">Some Users</option>
<option value="password" t-att-selected="widget.page.visibility == 'password' ? 'selected' : undefined">Password</option>
<option value="employee" t-att-selected="widget.page.visibility == 'employee' ? 'selected' : undefined">Internal users</option>
</select>
<div class="ml-1 input-group-prepend show_visibility_password" >
<div class="input-group-text"><i class="fa fa-key"></i></div>