diff --git a/addons/website_slides/models/slide_channel.py b/addons/website_slides/models/slide_channel.py index c66af6d853e..569b18e8f91 100644 --- a/addons/website_slides/models/slide_channel.py +++ b/addons/website_slides/models/slide_channel.py @@ -182,11 +182,12 @@ class Channel(models.Model): for record in self: record.completed, record.completion = mapped_data.get(record.id, (False, 0)) - @api.one - @api.depends('visibility', 'partner_ids', 'upload_group_ids') + @api.depends('channel_type', 'partner_ids', 'upload_group_ids') def _compute_access(self): - self.can_upload = not self.env.user.share and (not self.upload_group_ids or bool(self.upload_group_ids & self.env.user.groups_id)) - self.can_publish = self.can_upload and self.env.user.has_group('website.group_website_publisher') + for record in self: + is_doc = record.channel_type == 'documentation' + record.can_upload = not self.env.user.share and (not record.upload_group_ids or bool(record.upload_group_ids & self.env.user.groups_id)) + record.can_publish = record.can_upload and self.env.user.has_group('website.group_website_publisher') and (is_doc or record.user_id == self.env.user) @api.multi @api.depends('name') diff --git a/addons/website_slides/tests/common.py b/addons/website_slides/tests/common.py index 6745da6614a..041d5621e4f 100644 --- a/addons/website_slides/tests/common.py +++ b/addons/website_slides/tests/common.py @@ -42,6 +42,7 @@ class SlidesCase(common.SavepointCase): self.channel = self.env['slide.channel'].sudo(self.user_publisher).create({ 'name': 'Test Channel', + 'channel_type': 'documentation', 'promote_strategy': 'most_voted', 'visibility': 'public', 'website_published': True, diff --git a/addons/website_slides/tests/test_security.py b/addons/website_slides/tests/test_security.py index ae0911d8b14..55c2c6ede8c 100644 --- a/addons/website_slides/tests/test_security.py +++ b/addons/website_slides/tests/test_security.py @@ -121,3 +121,36 @@ class TestAccess(common.SlidesCase): self.slide.sudo(self.user_emp).read(['name']) self.slide.sudo(self.user_portal).read(['name']) self.slide.sudo(self.user_public).read(['name']) + + @mute_logger('odoo.models', 'odoo.addons.base.models.ir_rule') + def test_channel_features(self): + channel_publisher = self.channel.sudo(self.user_publisher) + self.assertEqual(channel_publisher.user_id, self.user_publisher) + self.assertTrue(channel_publisher.can_upload) + self.assertTrue(channel_publisher.can_publish) + + # test upload group limitation + channel_publisher.write({'upload_group_ids': [(4, self.ref('base.group_system'))]}) + self.assertFalse(channel_publisher.can_upload) + self.assertFalse(channel_publisher.can_publish) + channel_publisher.write({'upload_group_ids': [(5, 0)]}) + self.assertTrue(channel_publisher.can_upload) + self.assertTrue(channel_publisher.can_publish) + + # share people cannot upload / publish even without limitations + channel_portal = self.channel.sudo(self.user_portal) + self.assertFalse(channel_portal.can_upload) + self.assertFalse(channel_portal.can_publish) + + # standard people can upload if groups are ok but not publish + channel_emp = self.channel.sudo(self.user_emp) + self.assertTrue(channel_emp.can_upload) + self.assertFalse(channel_emp.can_publish) + + # test training type limitation (responsible only publish) + channel_publisher.write({'channel_type': 'training', 'user_id': self.user_emp.id}) + self.assertTrue(channel_publisher.can_upload) + self.assertFalse(channel_publisher.can_publish) + # standard people should not be responsible as they still cannot publish + self.assertTrue(channel_emp.can_upload) + self.assertFalse(channel_emp.can_publish)