${13 + 13}
+Bonjour
', @@ -126,6 +137,20 @@ class TestMailRender(common.MailCommon): 'res_id': cls.test_template_jinja.id, }) + # Enable group-based template management + cls.env['ir.config_parameter'].set_param('mail.restrict.template.rendering', True) + + # User without the group "mail.group_mail_template_editor" + cls.user_rendering_restricted = common.mail_new_test_user( + cls.env, login='user_rendering_restricted', + groups='base.group_user', + company_id=cls.company_admin.id, + name='Jinja Restricted User', + notification_type='inbox', + signature='--\nErnest' + ) + cls.user_rendering_restricted.groups_id -= cls.env.ref('mail.group_mail_template_editor') + @users('employee') def test_evaluation_context(self): """ Test evaluation context and various ways of tweaking it. """ @@ -210,12 +235,16 @@ class TestMailRender(common.MailCommon): )[partner.id] self.assertIn(expected, result) - @users('employee') + @users('user_rendering_restricted') def test_template_rendering_function_call(self): """Test the case when the template call a custom function. + This function should not be called when the template is not rendered. """ - partner = self.env['res.partner'].browse(self.render_object.ids) + model = 'res.partner' + res_ids = self.env[model].search([], limit=1).ids + partner = self.env[model].browse(res_ids) + MailRenderMixin = self.env['mail.render.mixin'] def cust_function(): # Can not use "MagicMock" in a Jinja sand-boxed environment @@ -231,13 +260,40 @@ class TestMailRender(common.MailCommon):return value
""" context = {'cust_function': cust_function} - result = self.env['mail.render.mixin']._render_template_jinja( + result = self.env['mail.render.mixin'].with_user(self.user_admin)._render_template_jinja( src, partner._name, partner.ids, add_context=context )[partner.id] self.assertEqual(expected, result) self.assertTrue(cust_function.call) + with self.assertRaises(AccessError, msg='Simple user should not be able to render Jinja code'): + MailRenderMixin._render_template_jinja(src, model, res_ids, add_context=context) + + @users('user_rendering_restricted') + def test_template_render_static(self): + """Test that we render correctly static templates (without placeholders).""" + model = 'res.partner' + res_ids = self.env[model].search([], limit=1).ids + MailRenderMixin = self.env['mail.render.mixin'] + + result = MailRenderMixin._render_template_jinja(self.base_jinja_bits[0], model, res_ids)[res_ids[0]] + self.assertEqual(result, self.base_jinja_bits[0]) + + @users('user_rendering_restricted') + def test_template_rendering_restricted(self): + """Test if we correctly detect static template.""" + res_ids = self.env['res.partner'].search([], limit=1).ids + with self.assertRaises(AccessError, msg='Simple user should not be able to render Jinja code'): + self.env['mail.render.mixin']._render_template_jinja(self.base_jinja_bits[3], 'res.partner', res_ids) + + @users('employee') + def test_template_rendering_unrestricted(self): + """Test if we correctly detect static template.""" + res_ids = self.env['res.partner'].search([], limit=1).ids + result = self.env['mail.render.mixin']._render_template_jinja(self.base_jinja_bits[3], 'res.partner', res_ids)[res_ids[0]] + self.assertIn('26', result, 'Template Editor should be able to render Jinja code') + @users('employee') def test_template_rendering_various(self): """ Test static rendering """ @@ -319,3 +375,17 @@ class TestMailRender(common.MailCommon): src, partner._name, partner.ids, engine=engine, )[partner.id] self.assertEqual(result, expected) + + @users('user_rendering_restricted') + def test_is_jinja_template_condition_block_restricted(self): + """Test if we correctly detect condition block (which might contains code).""" + res_ids = self.env['res.partner'].search([], limit=1).ids + with self.assertRaises(AccessError, msg='Simple user should not be able to render Jinja code'): + self.env['mail.render.mixin']._render_template_jinja(self.base_jinja_bits[4], 'res.partner', res_ids) + + @users('employee') + def test_is_jinja_template_condition_block_unrestricted(self): + """Test if we correctly detect condition block (which might contains code).""" + res_ids = self.env['res.partner'].search([], limit=1).ids + result = self.env['mail.render.mixin']._render_template_jinja(self.base_jinja_bits[4], 'res.partner', res_ids)[res_ids[0]] + self.assertNotIn('Code not executed', result, 'The condition block did not work') diff --git a/addons/mail/tests/test_mail_template.py b/addons/mail/tests/test_mail_template.py new file mode 100644 index 00000000000..9c42e4d6fa3 --- /dev/null +++ b/addons/mail/tests/test_mail_template.py @@ -0,0 +1,65 @@ +# -*- coding: utf-8 -*- +# Part of Odoo. See LICENSE file for full copyright and licensing details. + +from odoo.tests import Form, users +from odoo.exceptions import AccessError +from odoo.addons.mail.tests.common import MailCommon + + +class TestMailTemplate(MailCommon): + @classmethod + def setUpClass(cls): + super(TestMailTemplate, cls).setUpClass() + # Enable the Jinja rendering restriction + cls.env['ir.config_parameter'].set_param('mail.restrict.template.rendering', True) + cls.user_employee.groups_id -= cls.env.ref('mail.group_mail_template_editor') + + cls.mail_template = cls.env['mail.template'].create({ + 'name': 'Test template', + 'subject': '${1 + 5}', + 'body_html': '${4 + 9}', + 'lang': '${object.lang}', + 'auto_delete': True, + 'model_id': cls.env.ref('base.model_res_partner').id, + }) + + @users('employee') + def test_mail_compose_message_content_from_template(self): + form = Form(self.env['mail.compose.message']) + form.template_id = self.mail_template + mail_compose_message = form.save() + + self.assertEqual(mail_compose_message.subject, '6', 'We must trust mail template values') + + @users('employee') + def test_mail_compose_message_content_from_template_mass_mode(self): + mail_compose_message = self.env['mail.compose.message'].create({ + 'composition_mode': 'mass_mail', + 'model': 'res.partner', + 'template_id': self.mail_template.id, + 'subject': '${1 + 5}', + }) + + values = mail_compose_message.get_mail_values(self.partner_employee.ids) + + self.assertEqual(values[self.partner_employee.id]['subject'], '6', 'We must trust mail template values') + self.assertIn('13', values[self.partner_employee.id]['body_html'], 'We must trust mail template values') + + def test_mail_template_acl(self): + # Sanity check + self.assertTrue(self.user_admin.has_group('mail.group_mail_template_editor')) + self.assertFalse(self.user_employee.has_group('mail.group_mail_template_editor')) + + # Group System can create / write / unlink mail template + mail_template = self.env['mail.template'].with_user(self.user_admin).create({'name': 'Test template'}) + self.assertEqual(mail_template.name, 'Test template') + + mail_template.with_user(self.user_admin).name = 'New name' + self.assertEqual(mail_template.name, 'New name') + + # Standard employee can not + with self.assertRaises(AccessError): + self.env['mail.template'].with_user(self.user_employee).create({}) + + with self.assertRaises(AccessError): + mail_template.with_user(self.user_employee).name = 'Test write' diff --git a/addons/mail/views/res_config_settings_views.xml b/addons/mail/views/res_config_settings_views.xml index d210a49cc4a..2b79e01497d 100644 --- a/addons/mail/views/res_config_settings_views.xml +++ b/addons/mail/views/res_config_settings_views.xml @@ -44,6 +44,18 @@ +Body for: ${object.name}link
" + 'body_html': 'Body for: ${object.name}link', + }) + + with self.mock_mail_gateway(): + test_record.with_user(self.user_employee).message_post_with_template(self.email_template.id, composition_mode='mass_mail') + + new_partner = self.env['res.partner'].search([('email', '=', 'test@example.com')]) + + self.assertSentEmail( + self.user_employee.partner_id, + [new_partner], + subject='About %s' % test_record.name, + body_content=test_record.name, + attachments=[]) diff --git a/addons/website_slides/wizard/slide_channel_invite_views.xml b/addons/website_slides/wizard/slide_channel_invite_views.xml index 8dc27c81f49..a9026c3b27c 100644 --- a/addons/website_slides/wizard/slide_channel_invite_views.xml +++ b/addons/website_slides/wizard/slide_channel_invite_views.xml @@ -18,7 +18,8 @@