From c38f7295430ae18cf61a0cf9c3c9afacab7bdb45 Mon Sep 17 00:00:00 2001 From: Xavier Morel Date: Thu, 24 Oct 2013 13:17:10 +0200 Subject: [PATCH 1/6] [FIX] auth of pagenew bzr revid: xmo@openerp.com-20131024111710-5ghadng4we3p2cgg --- addons/website/controllers/main.py | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/addons/website/controllers/main.py b/addons/website/controllers/main.py index 30f384a606b..60d20f54c40 100644 --- a/addons/website/controllers/main.py +++ b/addons/website/controllers/main.py @@ -51,8 +51,7 @@ class Website(openerp.addons.web.controllers.main.Home): def index(self, **kw): return self.page("website.homepage") - # FIXME: auth, if /pagenew known anybody can create new empty page - @website.route('/pagenew/', type='http', auth="admin") + @website.route('/pagenew/', type='http', auth="user") def pagenew(self, path, noredirect=NOPE): module = 'website' # completely arbitrary max_length From 39fb50d43d4f3f0adba2c37ee345c3ac44cc84d4 Mon Sep 17 00:00:00 2001 From: Xavier Morel Date: Thu, 24 Oct 2013 15:16:13 +0200 Subject: [PATCH 2/6] [REM] explicit cache clearing, fixing ir.translation instead bzr revid: xmo@openerp.com-20131024131613-6hebrxi5dbbs82ph --- addons/website/controllers/main.py | 1 - 1 file changed, 1 deletion(-) diff --git a/addons/website/controllers/main.py b/addons/website/controllers/main.py index 60d20f54c40..64357e1a443 100644 --- a/addons/website/controllers/main.py +++ b/addons/website/controllers/main.py @@ -214,7 +214,6 @@ class Website(openerp.addons.web.controllers.main.Home): 'value': new_content, } irt.create(request.cr, request.uid, new_trans) - irt._get_source.clear_cache(irt) # FIXME: find why ir.translation does not invalidate return True @website.route('/website/attach', type='http', auth='user') From a2a3f46d7281217d5958ffdaceab0f290b0065d1 Mon Sep 17 00:00:00 2001 From: Xavier Morel Date: Thu, 24 Oct 2013 15:57:30 +0200 Subject: [PATCH 3/6] [FIX] 'inline' set_image_data bzr revid: xmo@openerp.com-20131024135730-321532upt3aq5esw --- addons/website/controllers/main.py | 13 +++---------- 1 file changed, 3 insertions(+), 10 deletions(-) diff --git a/addons/website/controllers/main.py b/addons/website/controllers/main.py index 64357e1a443..69da43a3549 100644 --- a/addons/website/controllers/main.py +++ b/addons/website/controllers/main.py @@ -327,21 +327,14 @@ class Images(http.Controller): if response.status_code == 304: return response - return self.set_image_data( - response, record[field].decode('base64'), - fit=(int(max_width), int(max_height))) + data = record[field].decode('base64') + fit = int(max_width), int(max_height) - def set_image_data(self, response, data, fit=(maxint, maxint)): - """ Sets an inferred mime type on the response object, and puts the - provided image's data in it, possibly after resizing if requested - - Returns the response object after setting its mime and content, so - the result of ``get_final_image`` can be returned directly. - """ buf = cStringIO.StringIO(data) # FIXME: unknown format or not an image image = Image.open(buf) + image.load() response.mimetype = Image.MIME[image.format] w, h = image.size From c8dd901b047a351eb50056667a5af9d99f52438d Mon Sep 17 00:00:00 2001 From: Xavier Morel Date: Thu, 24 Oct 2013 16:10:24 +0200 Subject: [PATCH 4/6] [FIX] todo/notes bzr revid: xmo@openerp.com-20131024141024-3kdx3jfcsn8vzsyg --- addons/website/controllers/main.py | 1 - addons/website/static/src/js/website.snippets.js | 4 ++-- 2 files changed, 2 insertions(+), 3 deletions(-) diff --git a/addons/website/controllers/main.py b/addons/website/controllers/main.py index 69da43a3549..417fca99b27 100644 --- a/addons/website/controllers/main.py +++ b/addons/website/controllers/main.py @@ -332,7 +332,6 @@ class Images(http.Controller): buf = cStringIO.StringIO(data) - # FIXME: unknown format or not an image image = Image.open(buf) image.load() response.mimetype = Image.MIME[image.format] diff --git a/addons/website/static/src/js/website.snippets.js b/addons/website/static/src/js/website.snippets.js index 0b1ab4e13cd..c29325c8de8 100644 --- a/addons/website/static/src/js/website.snippets.js +++ b/addons/website/static/src/js/website.snippets.js @@ -25,8 +25,8 @@ save: function () { this.snippets.make_active(false); - // TODO TOFIX: call clean_for_save on all snippets of the page, not only modified ones - // important for banner of parallax that changes data automatically. + // FIXME: call clean_for_save on all snippets of the page, not only modified ones + // important for banner of parallax that changes data automatically. this.snippets.clean_for_save(); remove_added_snippet_id(); this._super(); From 4c88701f3dbf12414540db95d98b18ab628ff142 Mon Sep 17 00:00:00 2001 From: Xavier Morel Date: Fri, 25 Oct 2013 11:59:52 +0200 Subject: [PATCH 5/6] [FIX] change access rights for customize_template_* bzr revid: xmo@openerp.com-20131025095952-9ditm4q3fwr9auto --- addons/website/controllers/main.py | 4 ++-- addons/website/static/src/js/website.editor.js | 1 - 2 files changed, 2 insertions(+), 3 deletions(-) diff --git a/addons/website/controllers/main.py b/addons/website/controllers/main.py index 417fca99b27..2f49071adf6 100644 --- a/addons/website/controllers/main.py +++ b/addons/website/controllers/main.py @@ -130,7 +130,7 @@ class Website(openerp.addons.web.controllers.main.Home): html = request.website.render('website.404', values) return html - @website.route('/website/customize_template_toggle', type='json', auth='admin') # FIXME: auth + @website.route('/website/customize_template_toggle', type='json', auth='user') def customize_template_set(self, view_id): view_obj = request.registry.get("ir.ui.view") view = view_obj.browse(request.cr, request.uid, int(view_id), @@ -144,7 +144,7 @@ class Website(openerp.addons.web.controllers.main.Home): }, context=request.context) return True - @website.route('/website/customize_template_get', type='json', auth='admin') # FIXME: auth + @website.route('/website/customize_template_get', type='json', auth='user') def customize_template_get(self, xml_id, optional=True): imd = request.registry['ir.model.data'] view_model, view_theme_id = imd.get_object_reference( diff --git a/addons/website/static/src/js/website.editor.js b/addons/website/static/src/js/website.editor.js index f9d2aef339b..6fb0f459a22 100644 --- a/addons/website/static/src/js/website.editor.js +++ b/addons/website/static/src/js/website.editor.js @@ -517,7 +517,6 @@ fetch_editables: function (root) { return $(root).find('[data-oe-model]') - // FIXME: propagation should make "meta" blocks non-editable in the first place... .not('link, script') .not('.oe_snippet_editor') .filter(function () { From 77e79435d08a1a83bf8c2fad8216773304bafadb Mon Sep 17 00:00:00 2001 From: Xavier Morel Date: Fri, 25 Oct 2013 12:24:21 +0200 Subject: [PATCH 6/6] [ADD] blog.tag access rights so public user can read blog Issue was no access rights on blog.tag, add ability for all users to read them, and for "knowledge" users to edit them. Also fix pre-existing access rights and move them to knowledge users, not users in general. bzr revid: xmo@openerp.com-20131025102421-0c86z775nedzgqyi --- addons/website_blog/security/ir.model.access.csv | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/addons/website_blog/security/ir.model.access.csv b/addons/website_blog/security/ir.model.access.csv index bfaef7af5f8..13dbed9967c 100644 --- a/addons/website_blog/security/ir.model.access.csv +++ b/addons/website_blog/security/ir.model.access.csv @@ -1,5 +1,7 @@ id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink blog_category_all,blog.category,model_blog_category,,1,0,0,0 blog_post_all,blog.post,model_blog_post,,1,0,0,0 -blog_post,blog.post,model_blog_post,base.group_user,1,1,1,1 -blog_post_history,blog.post.history,model_blog_post_history,base.group_user,1,0,1,0 +blog_post,blog.post,model_blog_post,base.group_document_user,1,1,1,1 +blog_post_history,blog.post.history,model_blog_post_history,base.group_document_user,1,0,1,0 +blog_tag,blog.tag,model_blog_tag,,1,0,0,0 +blog_tag_edition,blog.tag,model_blog_tag,base.group_document_user,1,1,1,1