From a24f15d62899e9aaab49e7cfcf253565f38f7830 Mon Sep 17 00:00:00 2001 From: bram1000 Date: Tue, 6 Feb 2024 12:15:14 +0100 Subject: [PATCH] [FIX] website_slides, website_twitter: restrict keys from employees Social users / managers shouldn't be able to access these keys, only admin should. For instance, in the user interface, it's only displayed in settings, which is available to administrators only. Task-3762961 Signed-off-by: Yannick Tivisse --- addons/website_slides/models/slide_slide.py | 4 ++-- addons/website_slides/models/website.py | 2 +- addons/website_twitter/controllers/main.py | 4 ++-- addons/website_twitter/models/website_twitter.py | 8 ++++---- 4 files changed, 9 insertions(+), 9 deletions(-) diff --git a/addons/website_slides/models/slide_slide.py b/addons/website_slides/models/slide_slide.py index 98c8ef50b65..1a81ff84a18 100644 --- a/addons/website_slides/models/slide_slide.py +++ b/addons/website_slides/models/slide_slide.py @@ -1060,7 +1060,7 @@ class Slide(models.Model): (e.g: 'Video could not be found') """ self.ensure_one() - google_app_key = self.env['website'].get_current_website().website_slide_google_app_key + google_app_key = self.env['website'].get_current_website().sudo().website_slide_google_app_key error_message = False try: response = requests.get( @@ -1151,7 +1151,7 @@ class Slide(models.Model): params['access_token'] = access_token if not params.get('access_token'): - params['key'] = self.env['website'].get_current_website().website_slide_google_app_key + params['key'] = self.env['website'].get_current_website().sudo().website_slide_google_app_key error_message = False try: diff --git a/addons/website_slides/models/website.py b/addons/website_slides/models/website.py index da287b5fbb5..063b85e4061 100644 --- a/addons/website_slides/models/website.py +++ b/addons/website_slides/models/website.py @@ -8,7 +8,7 @@ from odoo.addons.http_routing.models.ir_http import url_for class Website(models.Model): _inherit = "website" - website_slide_google_app_key = fields.Char('Google Doc Key') + website_slide_google_app_key = fields.Char('Google Doc Key', groups='base.group_system') def get_suggested_controllers(self): suggested_controllers = super(Website, self).get_suggested_controllers() diff --git a/addons/website_twitter/controllers/main.py b/addons/website_twitter/controllers/main.py index 92c11a1d4ec..45afe48ddb3 100644 --- a/addons/website_twitter/controllers/main.py +++ b/addons/website_twitter/controllers/main.py @@ -14,8 +14,8 @@ class Twitter(http.Controller): @http.route(['/website_twitter/get_favorites'], type='json', auth="public", website=True) def get_tweets(self, limit=20): - key = request.website.twitter_api_key - secret = request.website.twitter_api_secret + key = request.website.sudo().twitter_api_key + secret = request.website.sudo().twitter_api_secret screen_name = request.website.twitter_screen_name debug = request.env['res.users'].has_group('website.group_website_restricted_editor') if not key or not secret: diff --git a/addons/website_twitter/models/website_twitter.py b/addons/website_twitter/models/website_twitter.py index f7de73301dd..97333d8b534 100644 --- a/addons/website_twitter/models/website_twitter.py +++ b/addons/website_twitter/models/website_twitter.py @@ -19,8 +19,8 @@ _logger = logging.getLogger(__name__) class WebsiteTwitter(models.Model): _inherit = 'website' - twitter_api_key = fields.Char(string='Twitter API key', help='Twitter API Key') - twitter_api_secret = fields.Char(string='Twitter API secret', help='Twitter API Secret') + twitter_api_key = fields.Char(string='Twitter API key', help='Twitter API Key', groups='base.group_system') + twitter_api_secret = fields.Char(string='Twitter API secret', help='Twitter API Secret', groups='base.group_system') twitter_screen_name = fields.Char(string='Get favorites from this screen name') @api.model @@ -49,7 +49,7 @@ class WebsiteTwitter(models.Model): WebsiteTweets = self.env['website.twitter.tweet'] tweet_ids = [] for website in self: - if not all((website.twitter_api_key, website.twitter_api_secret, website.twitter_screen_name)): + if not all((website.sudo().twitter_api_key, website.sudo().twitter_api_secret, website.twitter_screen_name)): _logger.debug("Skip fetching favorite tweets for unconfigured website %s", website) continue params = {'screen_name': website.twitter_screen_name} @@ -80,7 +80,7 @@ class WebsiteTwitter(models.Model): r = requests.post( REQUEST_TOKEN_URL, data={'grant_type': 'client_credentials',}, - auth=(website.twitter_api_key, website.twitter_api_secret), + auth=(website.sudo().twitter_api_key, website.sudo().twitter_api_secret), timeout=URLOPEN_TIMEOUT, ) r.raise_for_status()