pengyuthon/odoo_source
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[REF] website, *: review website access rights

Browse Source 
* event, website_event, website_forum,
* website_hr_recruitment, website_sale

Website access rights were buggy. The editor assets and website editor
assets have to be loaded together to work so the previous behavior
which only loaded one with the restricted access right was not right.
Also, people which had the "Manager" access right for model like event
or job only got access to creation and edition of those objects if they
had the full access to website access rights.

Now the website module creates the two same groups :
* group_website_publisher: load all editor assets, give access to
page creation for model the user has access (event, job, ...) and
edition of those pages
* group_website_designer: implies the first one and give access in
creation and edition of all pages + access of all website menus

The manager access rights for event, product, jobs, etc now implies
the group_website_publisher group for the user (so that the manager
have the editor assets and editor ui).
Note: some python codes use the group_website_publisher for no right
reason, this has to be adapted.
This commit is contained in:
qsm-odoo
2016-09-28 15:56:04 +02:00
parent 7cbb2e6ed3
commit d04a42022b
17 changed files with 76 additions and 75 deletions
Download Patch File Download Diff File Expand all files Collapse all files
addons/event/security/event_security.xml
-3
View File
@@ -1,7 +1,6 @@
<?xml version="1.0" encoding="utf-8"?>
<odoo>
<data noupdate="0">
<record id="group_event_user" model="res.groups">
<field name="name">User</field>
<field name="implied_ids" eval="[(4, ref('base.group_user'))]"/>
@@ -14,8 +13,6 @@
<field name="implied_ids" eval="[(4, ref('group_event_user'))]"/>
<field name="users" eval="[(4, ref('base.user_root'))]"/>
</record>
</data>
<data noupdate="1">
addons/web_editor/static/src/js/editor.js
+1 -1
View File
@@ -16,7 +16,7 @@ var editor = {};
editor.dummy = function () {return true;}; // used for snippets, options...
editor.editable = !!$('html').data('editable');
editor.editable = !!($('html').data('editable') || $("[data-oe-model]").length); // temporary hack, this should be done in python
ajax.loadXML('/web_editor/static/src/xml/editor.xml', qweb);
addons/website/__manifest__.py
+1 -1
View File
@@ -18,8 +18,8 @@ Odoo Website CMS
'data': [
'data/website_data.xml',
'data/web_planner_data.xml',
'security/ir.model.access.csv',
'security/website_security.xml',
'security/ir.model.access.csv',
'views/website_templates.xml',
'views/website_navbar_templates.xml',
addons/website/data/website_data.xml
-17
View File
@@ -30,23 +30,6 @@
<field name="website_id" ref="default_website"/>
</record>
<record id="group_website_publisher" model="res.groups">
<field name="name">Editor</field>
<field name="category_id" ref="base.module_category_website"/>
</record>
<!-- Access rules to edit ir.ui.view with qWeb type -->
<record id="group_website_designer" model="res.groups">
<field name="name">Editor and Designer</field>
<field name="users" eval="[(4, ref('base.user_root'))]"/>
<field name="implied_ids" eval="[(4, ref('group_website_publisher'))]"/>
<field name="category_id" ref="base.module_category_website"/>
</record>
<record id="base.default_user" model="res.users">
<field name="groups_id" eval="[(4,ref('group_website_designer'))]"/>
</record>
<record id="action_module_website" model="ir.actions.act_window">
<field name="name">Website Apps</field>
<field name="res_model">ir.module.module</field>
addons/website/security/website_security.xml
+15
View File
@@ -1,5 +1,20 @@
<?xml version="1.0" encoding="utf-8"?>
<odoo>
<record id="group_website_publisher" model="res.groups">
<field name="name">Restricted Editor</field>
<field name="category_id" ref="base.module_category_website"/>
</record>
<record id="group_website_designer" model="res.groups">
<field name="name">Editor and Designer</field>
<field name="users" eval="[(4, ref('base.user_root'))]"/>
<field name="implied_ids" eval="[(4, ref('group_website_publisher'))]"/>
<field name="category_id" ref="base.module_category_website"/>
</record>
<record id="base.default_user" model="res.users">
<field name="groups_id" eval="[(4, ref('group_website_designer'))]"/>
</record>
<record id="website_designer_edit_qweb" model="ir.rule">
<field name="name">website_designer: Manage Website and qWeb view</field>
<field name="model_id" ref="base.model_ir_ui_view"/>
addons/website/views/website_navbar_templates.xml
+14 -14
View File
@@ -30,21 +30,21 @@
<div class="o_menu_brand">Website</div>
<ul class="o_menu_sections">
<ul class="o_menu_sections" groups="website.group_website_designer">
<!-- Content -->
<li class="dropdown content" groups="website.group_website_publisher" t-if="editable">
<li class="dropdown content" t-if="editable">
<a id="content-menu-button" class="dropdown-toggle waves" data-toggle="dropdown" href="#">Content</a>
<ul class="dropdown-menu oe_content_menu" role="menu">
<li groups="website.group_website_designer">
<li>
<a data-action="edit_menu" href="#" title="Edit Top Menu">Edit Menu</a>
</li>
<li t-if="deletable" groups="website.group_website_designer" role="separator" class="divider"></li>
<li t-if="deletable" groups="website.group_website_designer"><a href="#" data-action="rename_page">Rename Page</a></li>
<li t-if="deletable" groups="website.group_website_designer"><a href="#" data-action="delete_page">Delete Page</a></li>
<li t-if="deletable" role="separator" class="divider"></li>
<li t-if="deletable"><a href="#" data-action="rename_page">Rename Page</a></li>
<li t-if="deletable"><a href="#" data-action="delete_page">Delete Page</a></li>
</ul>
</li>
<!-- Customize -->
<li class="dropdown" groups="website.group_website_designer" id="customize-menu">
<li class="dropdown" id="customize-menu">
<a class="dropdown-toggle waves" data-toggle="dropdown" href="#" id="customize-menu-button">Customize</a>
<ul class="dropdown-menu" role="menu">
<li id="html_editor"><a data-action="ace" href="#advanced-view-editor">HTML Editor</a></li>
@@ -54,7 +54,7 @@
</ul>
</li>
<!-- Promote -->
<li class="dropdown" groups="website.group_website_designer">
<li class="dropdown">
<a class="dropdown-toggle waves" data-toggle="dropdown" href="#" id="promote-menu-button">Promote</a>
<ul class="dropdown-menu oe_promote_menu" role="menu">
<li><a data-action="promote-current-page" href="#" title="Promote page on the web">Optimize SEO</a></li>
@@ -62,22 +62,22 @@
</li>
</ul>
<ul class="o_menu_systray hidden-xs">
<ul class="o_menu_systray hidden-xs" groups="website.group_website_publisher">
<!-- Mobile preview -->
<li class="o_mobile_preview">
<a data-action="show-mobile-preview" href="#"><span title="Mobile preview" class="fa fa-mobile"/></a>
</li>
<!-- Page Edition -->
<li groups="website.group_website_publisher,website.group_website_designer">
<li>
<a data-action="new_page" href="#" data-toggle="modal" data-target="#o_website_add_page_modal"><span class="fa fa-plus"/>New</a>
</li>
<li t-if="not translatable" groups="website.group_website_publisher">
<li t-if="not translatable">
<a data-action="edit" href="#"><span class="fa fa-pencil"/>Edit</a>
</li>
<li t-if="translatable" groups="website.group_website_publisher">
<li t-if="translatable">
<a data-action="translate" href="#">TRANSLATE</a>
</li>
<li t-if="translatable" groups="website.group_website_publisher">
<li t-if="translatable">
<a data-action="edit_master" href="#">or Edit Master</a>
</li>
</ul>
@@ -86,7 +86,7 @@
<!-- Add new page/content modal -->
<xpath expr="//div[@id='wrapwrap']" position="after">
<div groups="base.group_user" class="modal" id="o_website_add_page_modal">
<div groups="website.group_website_publisher" class="modal" id="o_website_add_page_modal">
<div class="modal-dialog modal-lg">
<ul>
<li groups="website.group_website_designer"><a href="#" data-action="new_page"><i class="fa fa-file-o"/><p>New Page</p></a></li>
addons/website/views/website_templates.xml
+4 -5
View File
@@ -46,7 +46,6 @@
<script type="text/javascript" src="/website/static/src/js/website.snippets.editor.js"></script>
<script type="text/javascript" src="/website/static/src/js/website.snippets.gallery.js"></script>
</template>
<!-- Layout -->
@@ -130,14 +129,14 @@
<t t-call-assets="web.assets_common" t-js="false"/>
<t t-call-assets="web.assets_frontend" t-js="false"/>
<t t-call-assets="web_editor.summernote" t-js="false" groups="website.group_website_designer"/>
<t t-call-assets="web_editor.assets_editor" t-js="false" groups="website.group_website_designer"/>
<t t-call-assets="web_editor.summernote" t-js="false" groups="website.group_website_publisher"/>
<t t-call-assets="web_editor.assets_editor" t-js="false" groups="website.group_website_publisher"/>
<t t-call-assets="website.assets_editor" t-js="false" groups="website.group_website_publisher"/>
<t t-call-assets="web.assets_common" t-css="false"/>
<t t-call-assets="web.assets_frontend" t-css="false"/>
<t t-call-assets="web_editor.summernote" t-css="false" groups="website.group_website_designer"/>
<t t-call-assets="web_editor.assets_editor" t-css="false" groups="website.group_website_designer"/>
<t t-call-assets="web_editor.summernote" t-css="false" groups="website.group_website_publisher"/>
<t t-call-assets="web_editor.assets_editor" t-css="false" groups="website.group_website_publisher"/>
<t t-call-assets="website.assets_editor" t-css="false" groups="website.group_website_publisher"/>
</t>
<t t-set="head" t-value="head_website + (head or '')"/>
addons/website_event/security/website_event_security.xml
+4
View File
@@ -10,4 +10,8 @@
<field name="perm_create" eval="False"/>
<field name="perm_unlink" eval="False"/>
</record>
<record id="event.group_event_manager" model="res.groups">
<field name="implied_ids" eval="[(4, ref('website.group_website_publisher'))]"/>
</record>
</odoo>
addons/website_event/views/website_event_templates.xml
+2 -4
View File
@@ -47,10 +47,8 @@
<div class="row mt32 mb32">
<div class="col-md-9" id="middle_column">
<div class="text-center text-muted" t-if="not event_ids">
<h1>No event found</h1>
<t groups="website.group_website_publisher">
<p groups="event.group_event_manager">Use the top menu <i>'Content'</i> to create your first event.</p>
</t>
<h1>No event found</h1>
<p groups="event.group_event_manager">Use the top menu <i>'Content'</i> to create your first event.</p>
</div>
<ul class="media-list">
<li t-foreach="event_ids" t-as="event" class="media">
addons/website_forum/views/website_forum.xml
+4 -4
View File
@@ -740,8 +740,8 @@
<meta name="twitter:site" t-attf-content="@#{res_company.name}" />
<meta name="twitter:title" t-att-content="question.name" />
<meta name="twitter:description" t-att-content="question.content" />
<meta name="twitter:image" t-attf-content="#{request.httprequest.url_root}forum/user/#{question.create_uid.id}/avatar"/>
</t>
<meta name="twitter:image" t-attf-content="#{request.httprequest.url_root}forum/user/#{question.create_uid.id}/avatar"/>
</t>
<t t-call="website_forum.header">
<div class="alert alert-info text-center" role="alert" t-if="forum and question.state == 'pending' and user.karma>=forum.karma_moderate and question.active">
<a t-attf-href="/forum/#{slug(forum)}/post/#{slug(question)}/validate" type="button" class="btn btn-success">Accept <i class="fa fa-check"/></a>
@@ -1337,7 +1337,7 @@
<h1 class="mt0 page-header">
<span t-field="user.name"/>
<small>profile</small>
<t t-call="website.publish_management" groups="website.group_website_publisher">
<t t-call="website.publish_management">
<t t-set="object" t-value="user"/>
<t t-set="publish_edit" t-value="True"/>
</t>
@@ -1515,7 +1515,7 @@
<!-- User Navbar -->
<template id="content_new_forum" inherit_id="website.user_navbar">
<xpath expr="//div[@id='o_website_add_page_modal']//ul" position="inside">
<li groups="base.group_user"><a href="#" data-action="new_forum"><i class="fa fa-comment"/><p>New Forum</p></a></li>
<li groups="website.group_website_designer"><a href="#" data-action="new_forum"><i class="fa fa-comment"/><p>New Forum</p></a></li>
</xpath>
</template>
addons/website_hr_recruitment/security/website_hr_recruitment_security.xml
+5 -1
View File
@@ -41,5 +41,9 @@
<field name="perm_create" eval="False"/>
<field name="perm_unlink" eval="False"/>
</record>
<record id="hr_recruitment.group_hr_recruitment_manager" model="res.groups">
<field name="implied_ids" eval="[(4, ref('website.group_website_publisher'))]"/>
</record>
</data>
</odoo>
</odoo>
addons/website_hr_recruitment/views/website_hr_recruitment_templates.xml
+1 -3
View File
@@ -38,12 +38,10 @@
<div class="col-md-12" id="jobs_grid">
<div t-if="not jobs">
<div class="text-center text-muted">
<h3 class="css_editable_hidden"><a t-attf-href="/page/website.contactus">Contact us</a> for job opportunities.</h3>
<t groups="website.group_website_publisher">
<h3 class="css_editable_hidden"><a t-attf-href="/page/website.contactus">Contact us</a> for job opportunities.</h3>
<h4 groups="hr_recruitment.group_hr_recruitment_manager">
Create new job pages from the <strong><i>+New</i></strong> top-right button.
</h4>
</t>
</div>
</div>
<ul class="media-list" t-if="jobs">
addons/website_mail_channel/views/website_mail_channel_templates.xml
+8 -7
View File
@@ -7,18 +7,19 @@
</xpath>
</template>
<template id="head" inherit_id="website.assets_frontend" name="Mail Group Snippet">
<xpath expr="/t" position="inside">
<template id="assets_frontend" inherit_id="website.assets_frontend">
<xpath expr="//link[last()]" position="after">
<link rel="stylesheet" href="/website_mail_channel/static/src/css/website_mail_channel.css"/>
</xpath>
<xpath expr="//script[last()]" position="after">
<script type="text/javascript" src="/website_mail_channel/static/src/js/website_mail_channel.js"/>
<script type="text/javascript" src="/website_mail_channel/static/src/js/website_mail_channel.snippet.js"></script>
<script type="text/javascript" src="/website_mail_channel/static/src/js/website_mail_channel.snippet.js"/>
</xpath>
</template>
<template id="editor" inherit_id="website.assets_editor" name="Mail Group Editor">
<xpath expr="/t" position="inside">
<script type="text/javascript" src="/website_mail_channel/static/src/js/website_mail_channel.editor.js" groups="website.group_website_publisher"></script>
<template id="assets_editor" inherit_id="website.assets_editor">
<xpath expr="//script[last()]" position="after">
<script type="text/javascript" src="/website_mail_channel/static/src/js/website_mail_channel.editor.js"/>
</xpath>
</template>
addons/website_mass_mailing/views/website_mass_mailing_templates.xml
+8 -6
View File
@@ -1,16 +1,18 @@
<?xml version="1.0" encoding="utf-8"?>
<odoo>
<template id="assets_frontend" inherit_id="website.assets_frontend" name="Mail Frontend Assets">
<xpath expr="." position="inside">
<script type="text/javascript" src="/website_mass_mailing/static/src/js/website_mass_mailing.js"/>
<template id="assets_frontend" inherit_id="website.assets_frontend">
<xpath expr="//link[last()]" position="after">
<link rel="stylesheet" href="/mass_mailing/static/src/css/mass_mailing_popup.css" type="text/css"/>
</xpath>
<xpath expr="//script[last()]" position="after">
<script type="text/javascript" src="/website_mass_mailing/static/src/js/website_mass_mailing.js"/>
</xpath>
</template>
<template id="assets_editor" inherit_id="website.assets_editor" name="wesbite_mass_mailing Editor assets">
<xpath expr="/t" position="inside">
<script type="text/javascript" src="/website_mass_mailing/static/src/js/website_mass_mailing.editor.js" groups="website.group_website_publisher"/>
<template id="assets_editor" inherit_id="website.assets_editor">
<xpath expr="//script[last()]" position="after">
<script type="text/javascript" src="/website_mass_mailing/static/src/js/website_mass_mailing.editor.js"/>
</xpath>
</template>
addons/website_partner/views/website_partner_templates.xml
+2 -2
View File
@@ -12,7 +12,7 @@
<div class="oe_structure"/>
</div>
</t>
</template>
</template>
<template id="partner_detail" name="Partner Details">
<t t-call="website.publish_management">
@@ -41,4 +41,4 @@
<t t-raw="right_column or ''"/>
</div>
</template>
</odoo>
</odoo>
addons/website_sale/security/website_sale.xml
+4 -2
View File
@@ -11,7 +11,7 @@
<field name="perm_create" eval="False"/>
<field name="perm_unlink" eval="False"/>
</record>
<record id="product_supplierinfo_public" model="ir.rule">
<field name="name">Public product supplierinfo</field>
<field name="model_id" ref="product.model_product_supplierinfo"/>
@@ -41,5 +41,7 @@
<field name="category_id" ref="base.module_category_hidden"/>
</record>
<record id="sales_team.group_sale_manager" model="res.groups">
<field name="implied_ids" eval="[(4, ref('website.group_website_publisher'))]"/>
</record>
</odoo>
addons/website_sale/views/templates.xml
+3 -5
View File
@@ -201,9 +201,7 @@
<t t-if="not bins">
<div class="text-center text-muted">
<h3 class="css_editable_display">No product defined.</h3>
<t groups="website.group_website_publisher">
<p groups="sales_team.group_sale_manager">Click <i>'New'</i> in the top-right corner to create your first product.</p>
</t>
<p groups="sales_team.group_sale_manager">Click <i>'New'</i> in the top-right corner to create your first product.</p>
</div>
</t>
</div>
@@ -1139,7 +1137,7 @@
<div class="col-md-9 oe_cart">
<div class="row">
<t t-if="mode == ('new', 'billing')">
<h3 class="page-header mt16">Your Address
<h3 class="page-header mt16">Your Address
<small> or </small>
<a href='/web/signup?redirect=/shop/checkout' class='btn btn-primary' style="margin-top: -11px">Sign Up</a>
</h3>
@@ -1349,7 +1347,7 @@
<div class="list-group">
<t t-foreach='tokens' t-as='token'>
<a class="list-group-item btn_payment_token" t-att-data-acquirer="token.acquirer_id.id" t-att-data-token='token.id'>
<span class="js_radio fa fa-circle-o"></span>&amp;nbsp;
<span class="js_radio fa fa-circle-o"></span>&amp;nbsp;
<t t-esc="token.name" />
<t t-if="len(set(tokens.mapped('acquirer_id')))>1">
(<t t-esc='token.acquirer_id.name'/>)