diff --git a/addons/website_slides/models/slide_channel.py b/addons/website_slides/models/slide_channel.py index 1c391b253fa..dd772a8ec7b 100644 --- a/addons/website_slides/models/slide_channel.py +++ b/addons/website_slides/models/slide_channel.py @@ -136,8 +136,7 @@ class Channel(models.Model): # not stored access fields, depending on each user completed = fields.Boolean('Done', compute='_compute_user_statistics') completion = fields.Integer('Completion', compute='_compute_user_statistics') - can_upload = fields.Boolean('Can Upload', compute='_compute_access') - can_publish = fields.Boolean('Can Publish', compute='_compute_access') + can_upload = fields.Boolean('Can Upload', compute='_compute_can_upload') # karma generation karma_gen_slide_vote = fields.Integer(string='Lesson voted', default=1) karma_gen_channel_share = fields.Integer(string='Course shared', default=2) @@ -215,12 +214,25 @@ class Channel(models.Model): for record in self: record.completed, record.completion = mapped_data.get(record.id, (False, 0)) - @api.depends('channel_type', 'partner_ids', 'upload_group_ids') - def _compute_access(self): + @api.depends('upload_group_ids') + def _compute_can_upload(self): + for record in self: + record.can_upload = not self.env.user.share and (not record.upload_group_ids or bool(record.upload_group_ids & self.env.user.groups_id)) + + @api.depends('channel_type', 'user_id', 'can_upload') + def _compute_can_publish(self): + """ For channels of type 'training', only the responsible (see user_id field) can publish slides. + The 'sudo' user needs to be handled because he's the one used for uploads done on the front-end when the + logged in user is not publisher but fulfills the upload_group_ids condition. """ for record in self: is_doc = record.channel_type == 'documentation' - record.can_upload = not self.env.user.share and (not record.upload_group_ids or bool(record.upload_group_ids & self.env.user.groups_id)) - record.can_publish = record.can_upload and self.env.user.has_group('website.group_website_publisher') and (is_doc or record.user_id == self.env.user) + record.can_publish = record.can_upload \ + and self.env.user.has_group('website.group_website_publisher') \ + and (is_doc or record.user_id == self.env.user or self.env.user._is_superuser()) + + @api.model + def _get_can_publish_error_message(self): + return _("Publishing is restricted to the responsible of training courses or members of the publisher group for documentation courses") @api.multi @api.depends('name') diff --git a/addons/website_slides/models/slide_slide.py b/addons/website_slides/models/slide_slide.py index c705542e681..35b9fefc4e5 100644 --- a/addons/website_slides/models/slide_slide.py +++ b/addons/website_slides/models/slide_slide.py @@ -254,6 +254,15 @@ class Slide(models.Model): url = '%s/slides/slide/%s' % (base_url, slug(slide)) slide.website_url = url + @api.depends('channel_id.can_publish') + def _compute_can_publish(self): + for record in self: + record.can_publish = record.channel_id.can_publish + + @api.model + def _get_can_publish_error_message(self): + return _("Publishing is restricted to the responsible of training courses or members of the publisher group for documentation courses") + # --------------------------------------------------------- # ORM Overrides # --------------------------------------------------------- @@ -263,7 +272,7 @@ class Slide(models.Model): # Do not publish slide if user has not publisher rights channel = self.env['slide.channel'].browse(values['channel_id']) if not channel.can_publish: - values['website_published'] = False + # 'website_published' is handled by mixin values['date_published'] = False if not values.get('index_content'): @@ -288,9 +297,6 @@ class Slide(models.Model): @api.multi def write(self, values): - if 'website_published' in values and any(not slide.channel_id.can_publish for slide in self): - values.pop('website_published') - if values.get('url') and values['url'] != self.url: doc_data = self._parse_document_url(values['url']).get('values', dict()) for key, value in doc_data.items(): diff --git a/addons/website_slides/tests/test_security.py b/addons/website_slides/tests/test_security.py index 55c2c6ede8c..d9572732589 100644 --- a/addons/website_slides/tests/test_security.py +++ b/addons/website_slides/tests/test_security.py @@ -154,3 +154,8 @@ class TestAccess(common.SlidesCase): # standard people should not be responsible as they still cannot publish self.assertTrue(channel_emp.can_upload) self.assertFalse(channel_emp.can_publish) + + # superuser should always be able to publish even if he's not the responsible + channel_superuser = self.channel.sudo() + self.assertTrue(channel_superuser.can_upload) + self.assertTrue(channel_superuser.can_publish)