From bf8519853f2be8797c68d192e4231254e9fae58f Mon Sep 17 00:00:00 2001
From: Romain Derie <rde@odoo.com>
Date: Wed, 29 Nov 2017 13:52:43 +0100
Subject: [PATCH] [FIX] website: hide menu if related to an unpublished page

Before this commit, if there was a menu entry linked to an unpublished
website.page, the menu would be shown. For restricted users, they would land on
a 403 forbidden.

Now, we dont show website.page's menu if user can't access it.

This closes #21328
---
 addons/website/models/website.py           | 8 ++++++++
 addons/website/views/website_templates.xml | 4 ++--
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/addons/website/models/website.py b/addons/website/models/website.py
index 1b63929759e..d314ef5c902 100644
--- a/addons/website/models/website.py
+++ b/addons/website/models/website.py
@@ -807,6 +807,14 @@ class Menu(models.Model):
     child_id = fields.One2many('website.menu', 'parent_id', string='Child Menus')
     parent_left = fields.Integer('Parent Left', index=True)
     parent_right = fields.Integer('Parent Rigth', index=True)
+    is_visible = fields.Boolean(compute='_compute_visible', string='Is Visible')
+
+    @api.one
+    def _compute_visible(self):
+        visible = True
+        if self.page_id and not self.page_id.sudo().is_visible and not self.user_has_groups('base.group_user'):
+            visible = False
+        self.is_visible = visible
 
     @api.model
     def clean_url(self):
diff --git a/addons/website/views/website_templates.xml b/addons/website/views/website_templates.xml
index fbd817f25f2..fc4561c9980 100644
--- a/addons/website/views/website_templates.xml
+++ b/addons/website/views/website_templates.xml
@@ -67,14 +67,14 @@
 
 <!-- Layout -->
 <template id="submenu" name="Submenu">
-    <li t-if="not submenu.child_id" t-att-class="
+    <li t-if="submenu.is_visible and not submenu.child_id.filtered(lambda menu: menu.is_visible)" t-att-class="
         'active' if submenu.clean_url() and unslug_url(request.httprequest.path) == unslug_url(submenu.clean_url()) else None
         ">
         <a t-att-href="submenu.clean_url()" t-ignore="true" t-att-target="'_blank' if submenu.new_window else None">
             <span t-field="submenu.name"/>
         </a>
     </li>
-    <li t-if="submenu.child_id" t-attf-class="dropdown #{
+    <li t-if="submenu.is_visible and submenu.child_id.filtered(lambda menu: menu.is_visible)" t-attf-class="dropdown #{
         (submenu.clean_url() and submenu.clean_url() != '/' and any([request.httprequest.path == child.url for child in submenu.child_id if child.url]) or
          (submenu.clean_url() and request.httprequest.path == submenu.clean_url())) and 'active'
         }">