From 76bfcef0b98b03d2a0cb59c9691740cc1e57e6b3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Thibault=20Delavall=C3=A9e?= <tde@odoo.com>
Date: Mon, 25 Feb 2019 13:11:02 +0000
Subject: [PATCH] [FIX] website_slides: fix call to set_completed

Currently fullscreen widget calls a user-specific route as public user if
user is not logged. Purpose of this commit is to avoid JS crash. Some
code cleaning is also done. This small feature will have to be cleaned more
in-depth in a near future.

Commit linked to task ID 1942852 and PR #31394.
---
 addons/website_slides/controllers/main.py     | 38 +++++++++++++------
 .../src/js/slides_course_fullscreen_player.js | 16 ++++----
 2 files changed, 35 insertions(+), 19 deletions(-)

diff --git a/addons/website_slides/controllers/main.py b/addons/website_slides/controllers/main.py
index 06873df5b79..e7fd8c238b8 100644
--- a/addons/website_slides/controllers/main.py
+++ b/addons/website_slides/controllers/main.py
@@ -36,6 +36,17 @@ class WebsiteSlides(WebsiteProfile):
             if not qs or qs.lower() in loc:
                 yield {'loc': loc}
 
+    def _fetch_slide(self, slide_id):
+        slide = request.env['slide.slide'].browse(int(slide_id)).exists()
+        if not slide:
+            return {'error': 'slide_wrong'}
+        try:
+            slide.check_access_rights('read')
+            slide.check_access_rule('read')
+        except:
+            return {'error': 'slide_access'}
+        return {'slide': slide}
+
     def _set_viewed_slide(self, slide):
         if request.env.user._is_public() or slide.is_preview or not slide.channel_id.is_member:
             viewed_slides = request.session.setdefault('viewed_slides', list())
@@ -523,24 +534,27 @@ class WebsiteSlides(WebsiteProfile):
             'error': "You already passed this quiz"
         }
 
-    # SLIDE STATE CONTROLLERS
-    # TDE CLEANME: clean ctrlr / method name
+    # --------------------------------------------------
+    # SLIDE.SLIDE TOOLS CONTOLLERS
+    # --------------------------------------------------
 
-    @http.route('/slide/completed/<int:slide_id>', website=True, type="http", auth="user")
-    def mark_as_completed(self, slide_id, next_slide=None):
-        slide = request.env['slide.slide'].browse(slide_id)
+    @http.route('/slides/slide/<model("slide.slide"):slide>/set_completed', website=True, type="http", auth="user")
+    def slide_set_completed_and_redirect(self, slide, next_slide=None):
         self._set_completed_slide(slide)
-        return werkzeug.utils.redirect("/slides/slide/%s" %(next_slide))
+        return werkzeug.utils.redirect("/slides/slide/%s" % (next_slide if next_slide else slide.id))
 
-    @http.route('/slides/set_completed', website=True, type="json", auth="user")
-    def set_status_as_done(self, slide_id):
-        slide = request.env['slide.slide'].browse(slide_id)
-        self._set_completed_slide(slide)
+    @http.route('/slides/slide/set_completed', website=True, type="json", auth="public")
+    def slide_set_completed(self, slide_id):
+        if request.website.is_public_user():
+            return {'error': 'public_user'}
+        fetch_res = self._fetch_slide(slide_id)
+        if fetch_res.get('error'):
+            return fetch_res
+        self._set_completed_slide(fetch_res['slide'])
         return {
-            'channel_completion': slide.channel_id.completion
+            'channel_completion': fetch_res['slide'].channel_id.completion
         }
 
-    # JSONRPC
     @http.route('/slides/slide/like', type='json', auth="public", website=True)
     def slide_like(self, slide_id, upvote):
         if request.website.is_public_user():
diff --git a/addons/website_slides/static/src/js/slides_course_fullscreen_player.js b/addons/website_slides/static/src/js/slides_course_fullscreen_player.js
index 4141c5dc6e8..f41c75447e4 100644
--- a/addons/website_slides/static/src/js/slides_course_fullscreen_player.js
+++ b/addons/website_slides/static/src/js/slides_course_fullscreen_player.js
@@ -235,16 +235,18 @@ odoo.define('website_slides.fullscreen', function (require) {
         _setSlideStateAsDone: function (){
             var self = this;
             self._rpc({
-                route: '/slides/set_completed',
+                route: '/slides/slide/set_completed',
                 params: {
                     slide_id: self.slide.id,
                 }
-            }).then(function (data){
-                $('#check-'+self.slide.id).replaceWith($('<i class="check-done o_wslides_slide_completed fa fa-check-circle"></i>'));
-                self.slide.done = true;
-                clearInterval(self.tid);
-                self.channelCompletion = data.channel_completion;
-                self._updateProgressbar();
+            }).then(function (data) {
+                if (! data.error) {
+                    $('#check-'+self.slide.id).replaceWith($('<i class="check-done o_wslides_slide_completed fa fa-check-circle"></i>'));
+                    self.slide.done = true;
+                    clearInterval(self.tid);
+                    self.channelCompletion = data.channel_completion;
+                    self._updateProgressbar();
+                }
             });
         },
         _updateProgressbar: function (){