pengyuthon/odoo_source
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[FIX] website_slides, website_twitter: restrict keys from employees

Browse Source 
Social users / managers shouldn't be able to access these keys,
only admin should.

For instance, in the user interface, it's only displayed in
settings, which is available to administrators only.

Task-3762961

Signed-off-by: Yannick Tivisse <yti@odoo.com>
This commit is contained in:
bram1000
2024-02-08 15:43:18 +00:00
parent 8d1b0f6a7a
commit a24f15d628
4 changed files with 9 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
addons/website_slides/models/slide_slide.py
+2 -2
View File
@@ -1060,7 +1060,7 @@ class Slide(models.Model):
(e.g: 'Video could not be found') """
self.ensure_one()
google_app_key = self.env['website'].get_current_website().website_slide_google_app_key
google_app_key = self.env['website'].get_current_website().sudo().website_slide_google_app_key
error_message = False
try:
response = requests.get(
@@ -1151,7 +1151,7 @@ class Slide(models.Model):
params['access_token'] = access_token
if not params.get('access_token'):
params['key'] = self.env['website'].get_current_website().website_slide_google_app_key
params['key'] = self.env['website'].get_current_website().sudo().website_slide_google_app_key
error_message = False
try:
addons/website_slides/models/website.py
+1 -1
View File
@@ -8,7 +8,7 @@ from odoo.addons.http_routing.models.ir_http import url_for
class Website(models.Model):
_inherit = "website"
website_slide_google_app_key = fields.Char('Google Doc Key')
website_slide_google_app_key = fields.Char('Google Doc Key', groups='base.group_system')
def get_suggested_controllers(self):
suggested_controllers = super(Website, self).get_suggested_controllers()
addons/website_twitter/controllers/main.py
+2 -2
View File
@@ -14,8 +14,8 @@ class Twitter(http.Controller):
@http.route(['/website_twitter/get_favorites'], type='json', auth="public", website=True)
def get_tweets(self, limit=20):
key = request.website.twitter_api_key
secret = request.website.twitter_api_secret
key = request.website.sudo().twitter_api_key
secret = request.website.sudo().twitter_api_secret
screen_name = request.website.twitter_screen_name
debug = request.env['res.users'].has_group('website.group_website_restricted_editor')
if not key or not secret:
addons/website_twitter/models/website_twitter.py
+4 -4
View File
@@ -19,8 +19,8 @@ _logger = logging.getLogger(__name__)
class WebsiteTwitter(models.Model):
_inherit = 'website'
twitter_api_key = fields.Char(string='Twitter API key', help='Twitter API Key')
twitter_api_secret = fields.Char(string='Twitter API secret', help='Twitter API Secret')
twitter_api_key = fields.Char(string='Twitter API key', help='Twitter API Key', groups='base.group_system')
twitter_api_secret = fields.Char(string='Twitter API secret', help='Twitter API Secret', groups='base.group_system')
twitter_screen_name = fields.Char(string='Get favorites from this screen name')
@api.model
@@ -49,7 +49,7 @@ class WebsiteTwitter(models.Model):
WebsiteTweets = self.env['website.twitter.tweet']
tweet_ids = []
for website in self:
if not all((website.twitter_api_key, website.twitter_api_secret, website.twitter_screen_name)):
if not all((website.sudo().twitter_api_key, website.sudo().twitter_api_secret, website.twitter_screen_name)):
_logger.debug("Skip fetching favorite tweets for unconfigured website %s", website)
continue
params = {'screen_name': website.twitter_screen_name}
@@ -80,7 +80,7 @@ class WebsiteTwitter(models.Model):
r = requests.post(
REQUEST_TOKEN_URL,
data={'grant_type': 'client_credentials',},
auth=(website.twitter_api_key, website.twitter_api_secret),
auth=(website.sudo().twitter_api_key, website.sudo().twitter_api_secret),
timeout=URLOPEN_TIMEOUT,
)
r.raise_for_status()