From 6bba311d8cc8dea750bd386f0fecd2ddb8dcb1e3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=A9rome=20Maes?= <jem@openerp.com>
Date: Fri, 25 Sep 2015 10:33:51 +0200
Subject: [PATCH] [FIX] website_mail : force login to post comment

Transform POST param into GET param when redirecting to login page can cause security issues. Now, instead of displaying textarea (even if public user) and the redirect to login page keeping written comment, we display the login button with a redirection to the page to comment.
The redirection happen before commenting, avoiding to remenber param such comment text, rating, ...

To post a comment, the user must:
- be connected
- have a token
- or have a sha_sign
---
 addons/website_mail/views/website_mail.xml | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/addons/website_mail/views/website_mail.xml b/addons/website_mail/views/website_mail.xml
index 2e246ac18c2..a0d4b4e85a2 100644
--- a/addons/website_mail/views/website_mail.xml
+++ b/addons/website_mail/views/website_mail.xml
@@ -40,8 +40,10 @@
                 :chatter_mode string: 'json' or 'post' depending on what kind of request you want
         -->
         <section id="discussion" class="hidden-print oe_website_portal o_website_mail_thread">
-            <section class="mb32 css_editable_mode_hidden hidden-print">
-                <form class="o_website_chatter_form" t-attf-action="/website_mail/post/#{chatter_mode}" method="POST" t-if="website.env.user != request.env['ir.model.data'].xmlid_to_object('base.public_user') or token or sha_in">
+            <t t-set="is_user_public" t-value="website.env.user == request.website.user_id"/>
+            <t t-set="can_comment" t-value="sha_in or token or not is_user_public"/>
+            <section class="mb32 hidden-print" t-if="can_comment">
+                <form class="o_website_chatter_form" t-attf-action="/website_mail/post/#{chatter_mode}" method="POST">
                     <img class="img pull-left img-circle" t-attf-src="/web/image/res.partner/#{user_id.partner_id.id}/image_small/50x50" style="width: 50px; margin-right: 10px;"/>
                     <div class="pull-left mb32" style="width: 75%%">
                         <textarea rows="4" name="message" class="form-control" placeholder="Write a message..."></textarea>
@@ -58,6 +60,10 @@
                     </div>
                 </form>
             </section>
+            <section class="mb32 hidden-print" t-if="not can_comment">
+                <h3>Leave a comment</h3>
+                <p>You must be <a t-attf-href="/web/login?redirect=#{quote_plus(request.httprequest.url + '#discussion')}">logged in</a> to post a comment.</p>
+            </section>
             <div class="clearfix"/>
             <ul class="media-list o_website_comments">
                 <t t-foreach="object.message_ids" t-as="message">