pengyuthon/odoo_source
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[REF] link_tracker: do not let public read technical / private link data

Browse Source 
Link tracker models are rather technical and should not be accessed as it is
by external people. Let us delegate control to controllers and lessen a bit
model accessibility.

Currently everyone can use add_click method and generate statistics. Now
statistics will be generated only through dedicated routes. It will make
statistics more reliable and ensure technical data remain private.

Next commit will update code from controllers and main methods in order to be
have a more readable click API and avoid link between non dependent modules.

This commit is linked to task ID 1904277 and PR #28242.
This commit is contained in:
Thibault Delavallée
2019-01-14 10:34:21 +00:00
parent 9ee9724a10
commit 75638ffb94
3 changed files with 11 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
addons/link_tracker/controller/main.py
+1 -1
View File
@@ -11,6 +11,6 @@ class LinkTracker(http.Controller):
@http.route('/r/<string:code>', type='http', auth='none', website=True)
def full_url_redirect(self, code, **post):
country_code = request.session.geoip and request.session.geoip.get('country_code') or False
request.env['link.tracker.click'].add_click(code, request.httprequest.remote_addr, country_code, stat_id=False)
request.env['link.tracker.click'].sudo().add_click(code, request.httprequest.remote_addr, country_code, stat_id=False)
redirect_url = request.env['link.tracker'].get_url_from_code(code)
return werkzeug.utils.redirect(redirect_url or '', 301)
addons/link_tracker/security/ir.model.access.csv
+9 -6
View File
@@ -1,7 +1,10 @@
id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink
access_link_tracker_user,link.tracker,model_link_tracker,base.group_user,1,0,0,0
access_link_tracker_public,link.tracker,model_link_tracker,base.group_public,1,0,0,0
access_link_tracker_code_user,link.tracker.code,model_link_tracker_code,base.group_user,1,0,0,0
access_link_tracker_code_public,link.tracker.code,model_link_tracker_code,base.group_public,1,0,0,0
access_link_tracker_click_user,link.tracker.click,model_link_tracker_click,base.group_user,1,0,0,0
access_link_tracker_click_public,link.tracker.click,model_link_tracker_click,base.group_public,1,0,0,0
access_link_tracker_user,access.link.tracker.user,model_link_tracker,base.group_user,1,0,0,0
access_link_tracker_public,access.link.tracker.public,model_link_tracker,base.group_public,0,0,0,0
access_link_tracker_system,access.link.tracker.system,model_link_tracker,base.group_system,1,1,1,1
access_link_tracker_code_user,access.link.tracker.code.user,model_link_tracker_code,base.group_user,1,0,0,0
access_link_tracker_code_public,access.link.tracker.code.public,model_link_tracker_code,base.group_public,0,0,0,0
access_link_tracker_code_system,access.link.tracker.code.system,model_link_tracker_code,base.group_system,1,1,1,1
access_link_tracker_click_user,access.link.tracker.click.user,model_link_tracker_click,base.group_user,1,0,0,0
access_link_tracker_click_public,access.link.tracker.click.public,model_link_tracker_click,base.group_public,0,0,0,0
access_link_tracker_click_system,access.link.tracker.click.system,model_link_tracker_click,base.group_system,1,1,1,1
1 id name model_id:id group_id:id perm_read perm_write perm_create perm_unlink
2 access_link_tracker_user link.tracker access.link.tracker.user model_link_tracker base.group_user 1 0 0 0
3 access_link_tracker_public link.tracker access.link.tracker.public model_link_tracker base.group_public 1 0 0 0 0
4 access_link_tracker_code_user access_link_tracker_system link.tracker.code access.link.tracker.system model_link_tracker_code model_link_tracker base.group_user base.group_system 1 0 1 0 1 0 1
5 access_link_tracker_code_public access_link_tracker_code_user link.tracker.code access.link.tracker.code.user model_link_tracker_code base.group_public base.group_user 1 0 0 0
6 access_link_tracker_click_user access_link_tracker_code_public link.tracker.click access.link.tracker.code.public model_link_tracker_click model_link_tracker_code base.group_user base.group_public 1 0 0 0 0
7 access_link_tracker_click_public access_link_tracker_code_system link.tracker.click access.link.tracker.code.system model_link_tracker_click model_link_tracker_code base.group_public base.group_system 1 0 1 0 1 0 1
8 access_link_tracker_click_user access.link.tracker.click.user model_link_tracker_click base.group_user 1 0 0 0
9 access_link_tracker_click_public access.link.tracker.click.public model_link_tracker_click base.group_public 0 0 0 0
10 access_link_tracker_click_system access.link.tracker.click.system model_link_tracker_click base.group_system 1 1 1 1
addons/mass_mailing/controllers/main.py
+1 -1
View File
@@ -107,7 +107,7 @@ class MassMailController(http.Controller):
# which mass_mailing doesn't depend on
country_code = request.session.get('geoip', False) and request.session.geoip.get('country_code', False)
request.env['link.tracker.click'].add_click(code, request.httprequest.remote_addr, country_code, stat_id=stat_id)
request.env['link.tracker.click'].sudo().add_click(code, request.httprequest.remote_addr, country_code, stat_id=stat_id)
return werkzeug.utils.redirect(request.env['link.tracker'].get_url_from_code(code), 301)
@http.route('/mailing/blacklist/check', type='json', auth='none')