From aaa8a87f36478bca6504b2acfbe5e0a2e236fa4b Mon Sep 17 00:00:00 2001 From: Jeremy Kersten Date: Wed, 3 Jan 2018 12:37:28 +0100 Subject: [PATCH] [FIX] website_forum: check karma to allow to flag a post without rights to edit If you set 200 kamra to allow to flag a post and 300 to edit all post, you was not able to flag the post before this commit. This commit closes #21274 @kangol: warning, fwd port need to add tag_ids into trusted_keys --- addons/website_forum/models/forum.py | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/addons/website_forum/models/forum.py b/addons/website_forum/models/forum.py index 8b03a0a809c..cc9b20da7c8 100644 --- a/addons/website_forum/models/forum.py +++ b/addons/website_forum/models/forum.py @@ -436,7 +436,7 @@ class Post(models.Model): elif post.parent_id and not post.can_answer: raise KarmaError('Not enough karma to answer to a question') if not post.parent_id and not post.can_post: - post.state = 'pending' + post.sudo().state = 'pending' # add karma for posting new questions if not post.parent_id and post.state == 'active': @@ -466,11 +466,18 @@ class Post(models.Model): @api.multi def write(self, vals): + trusted_keys = ['active', 'is_correct'] # fields where security is checked manually if 'content' in vals: vals['content'] = self._update_content(vals['content'], self.forum_id.id) if 'state' in vals: - if vals['state'] in ['active', 'close'] and any(not post.can_close for post in self): - raise KarmaError('Not enough karma to close or reopen a post.') + if vals['state'] in ['active', 'close']: + if any(not post.can_close for post in self): + raise KarmaError('Not enough karma to close or reopen a post.') + trusted_keys += ['state', 'closed_uid', 'closed_date', 'closed_reason_id'] + elif vals['state'] == 'flagged': + if any(not post.can_flag for post in self): + raise KarmaError('Not enough karma to flag a post.') + trusted_keys += ['state', 'flag_user_id'] if 'active' in vals: if any(not post.can_unlink for post in self): raise KarmaError('Not enough karma to delete or reactivate a post') @@ -483,7 +490,7 @@ class Post(models.Model): if vals['is_correct'] != post.is_correct and post.create_uid.id != self._uid: post.create_uid.sudo().add_karma(post.forum_id.karma_gen_answer_accepted * mult) self.env.user.sudo().add_karma(post.forum_id.karma_gen_answer_accept * mult) - if any(key not in ['state', 'active', 'is_correct', 'closed_uid', 'closed_date', 'closed_reason_id'] for key in vals.keys()) and any(not post.can_edit for post in self): + if any(key not in trusted_keys for key in vals) and any(not post.can_edit for post in self): raise KarmaError('Not enough karma to edit a post.') res = super(Post, self).write(vals)