[IMP] website: security and public access

bzr revid: chm@openerp.com-20130802035504-lokijwh57e0q3w6a

addons/product/security/ir.model.access.csv

@@ -17,4 +17,4 @@ access_product_pricelist_partner_manager,product.pricelist partner manager,model
 access_product_product_employee,product.product employee,model_product_product,base.group_user,1,0,0,0
 access_product_template_sale_manager,product.template salemanager,model_product_template,base.group_sale_manager,1,1,1,1
 access_product_product_sale_manager,product.product salemanager,model_product_product,base.group_sale_manager,1,1,1,1
-access_product_category_sale_manager,product.category salemanager,product.model_product_category,base.group_sale_manager,1,1,1,1
+access_product_category_sale_manager,product.category salemanager,product.model_product_category,base.group_sale_manager,1,1,1,1

addons/website_mail/controllers/main.py

@@ -62,7 +62,7 @@ class website_mail(http.Controller):
 
     @http.route(['/blog/publish'], type='http', auth="public")
     def publish(self, **post):
-        message_id = int(post['message_id'])
+        message_id = int(post['id'])
         message_obj = request.registry['mail.message']
 
         blog = message_obj.browse(request.cr, request.uid, message_id)

addons/website_mail/static/src/js/blog.js

@@ -5,7 +5,7 @@ $(document).ready(function () {
         $link.find('.js_publish, .js_unpublish').addClass("hidden");
         var $unp = $link.find(".js_unpublish");
         var $p = $link.find(".js_publish");
-        $.post('/blog/publish/', {'message_id': $link.data('id')}, function (result) {
+        $.post('/blog/publish', {'id': $link.data('id')}, function (result) {
             if (+result) {
                 $p.addClass("hidden");
                 $unp.removeClass("hidden");

addons/website_sale/__init__.py

@@ -1,2 +1,3 @@
 import controllers
 import pricelist
+import product

addons/website_sale/__openerp__.py

@@ -11,7 +11,9 @@ OpenERP E-Commerce
     'depends': ['website', 'sale', 'point_of_sale'],
     'data': [
         'views/ecommerce.xml',
-        'views/pricelist.xml'
+        'views/pricelist.xml',
+        'security/ir.model.access.csv',
+        'security/ecommerce.xml',
     ],
     'qweb': ['static/src/xml/*.xml'],
     'installable': True,

addons/website_sale/controllers/main.py

@@ -71,7 +71,7 @@ class Ecommerce(http.Controller):
     @http.route(['/shop', '/shop/category/<cat_id>'], type='http', auth="public")
     def category(self, cat_id=0, offset=0, **post):
 
-        domain = []
+        domain = [("sale_ok", "=", True)]
         if post.get("search"):
             domain += ['|', '|', ('name', 'ilike', "%%%s%%" % post.get("search")), ('desrequest.cription', 'ilike', "%%%s%%" % post.get("search")), ('pos_categ_id.name', 'ilike', "%%%s%%" % post.get("search"))]
         if cat_id:
@@ -79,11 +79,11 @@ class Ecommerce(http.Controller):
             domain = [('pos_categ_id.id', 'child_of', cat_id)] + domain
 
         product_obj = request.registry.get('product.product')
-        product_ids = product_obj.search(request.cr, openerp.SUPERUSER_ID, domain or [(1, '=', 1)], limit=20, offset=offset)
+        product_ids = product_obj.search(request.cr, request.uid, domain, limit=20, offset=offset)
 
         values = {
             'current_category': cat_id,
-            'products': product_obj.browse(request.cr, openerp.SUPERUSER_ID, product_ids),
+            'products': product_obj.browse(request.cr, request.uid, product_ids),
             'search': post.get("search"),
         }
         html = self.render("website_sale.products", values)
@@ -314,4 +314,15 @@ class Ecommerce(http.Controller):
         }
         return self.render("website_sale.confirmed", values)
 
+    @http.route(['/shop/publish'], type='http', auth="public")
+    def publish(self, **post):
+        product_id = int(post['id'])
+        product_obj = request.registry['product.product']
+
+        product = product_obj.browse(request.cr, request.uid, product_id)
+        product_obj.write(request.cr, request.uid, [product_id], {'website_published': not product.website_published})
+        product = product_obj.browse(request.cr, request.uid, product_id)
+
+        return product.website_published and "1" or "0"
+
 # vim:expandtab:tabstop=4:softtabstop=4:shiftwidth=4:

addons/website_sale/product.py

@@ -0,0 +1,10 @@
+# -*- coding: utf-8 -*-
+
+from openerp.osv import osv, fields
+
+
+class product_pricelist(osv.osv):
+    _inherit = "product.product"
+    _columns = {
+        'website_published': fields.boolean('Available in the website'),
+    }

addons/website_sale/security/ecommerce.xml

@@ -0,0 +1,15 @@
+<?xml version="1.0" encoding="utf-8"?>
+<openerp>
+<data>
+    <record id="product_product_public" model="ir.rule">
+        <field name="name">product: Public product</field>
+        <field name="model_id" ref="product.model_product_product"/>
+        <field name="domain_force">[('website_published', '=', True), ("sale_ok", "=", True)]</field>
+        <field name="groups" eval="[(4, ref('base.group_public'))]"/>
+        <field name="perm_read" eval="True"/>
+        <field name="perm_write" eval="False"/>
+        <field name="perm_create" eval="False"/>
+        <field name="perm_unlink" eval="False"/>
+    </record>
+</data>
+</openerp>

addons/website_sale/security/ir.model.access.csv

@@ -0,0 +1,3 @@
+id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink
+access_product_product_public,product.product.public,product.model_product_product,base.group_public,1,0,0,0
+access_point_of_sale_category_public,point_of_sale.category.public,point_of_sale.model_pos_category,base.group_public,1,0,0,0

addons/website_sale/static/src/js/ecommerce.js

@@ -1,4 +1,21 @@
 $(document).ready(function () {
+    $('.oe_ecommerce').on('click', '.js_publish, .js_unpublish', function (e) {
+        e.preventDefault();
+        var $link = $(this).parent();
+        $link.find('.js_publish, .js_unpublish').addClass("hidden");
+        var $unp = $link.find(".js_unpublish");
+        var $p = $link.find(".js_publish");
+        $.post('/shop/publish', {'id': $link.data('id')}, function (result) {
+            if (+result) {
+                $p.addClass("hidden");
+                $unp.removeClass("hidden");
+            } else {
+                $p.removeClass("hidden");
+                $unp.addClass("hidden");
+            }
+        });
+    });
+
     $('.oe_ecommerce').on('click', '.oe_product .btn, .oe_product_detail .btn', function (e) {
         var $button = $(e.currentTarget);
         var $product = $button.parents('.oe_product:first, .oe_product_detail:first');

addons/website_sale/views/ecommerce.xml

@@ -16,6 +16,31 @@
            </data>
         </field>
     </record>
+    <record id="header_ecommerce" model="ir.ui.view">
+        <field name="name">header_ecommerce</field>
+        <field name="inherit_id" ref="website.header"/>
+        <field name="arch" type="xml">
+            <data>
+                <xpath expr="(//li)[last()]" position="after">
+                    <li class="pull-right"><a href="/shop/mycart"><i class="icon-shopping-cart icon-large" style="position: absolute;"></i>&amp;nbsp; &amp;nbsp; &amp;nbsp;  My cart</a></li>
+                    <li class="pull-right"><a href="/shop">Shop</a></li>
+                </xpath>
+           </data>
+        </field>
+    </record>
+
+    <record id="product_normal_form_view" model="ir.ui.view">
+        <field name="name">product.normal.form.inherit</field>
+        <field name="model">product.product</field>
+        <field name="inherit_id" ref="stock.view_normal_procurement_locations_form"/>
+        <field name="arch" type="xml">
+            <group name="sale" position="before">
+                <group name="pos" string="Website">
+                    <field name="website_published"/>
+                </group>
+            </group>
+        </field>
+    </record>
 
     <!-- Page Shop --> 
 
@@ -83,15 +108,20 @@
     <template id="product_card">
         <div class="media oe_product span3">
             <a t-att-href="'/shop/product/%%s' %% product.id"><h4 class="media-heading"><span t-record="product" t-field="name"><t t-esc="product.name"/></span></h4></a>
-            <a class="pull-left" t-att-href="'/shop/product/%%s' %% product.id"><img class="media-object" t-att-src="'data:image/png;base64,' + product.image"/></a>
+            <a class="pull-left" t-att-href="'/shop/product/%%s' %% product.id">
+                <img class="media-object" t-att-src="'data:image/png;base64,' + product.image"/>
+            </a>
             <div class="media-body">
                 <div class="oe_ecommerce_description" t-record="product" t-field="description_sale"><t t-esc="product.description_sale"/></div>
                 <div class="oe_ecommerce_price"><span><span t-record="product" t-field="list_price"><t t-esc="product.list_price"/></span>€</span></div>
                 <div class="oe_button_cart">
-                    <button t-att-class="'btn btn-small btn-inverse %%s' %% (not quantity and 'oe_hidden' or '')" t-att-data-id="product.id">Remove one</button>
-                    <button t-att-class="'btn btn-small %%s' %% (quantity and 'btn-success' or 'btn-primary')" t-att-data-id="product.id">Add to cart
-                        <span class="oe_txt">(<span class="oe_quantity"><t t-esc="quantity"/></span>)</span>
-                    </button>
+                    <div class="alert mb0" t-if="editable and not product.website_published">Product not published</div>
+                    <t t-if="product.website_published">
+                        <button t-att-class="'btn btn-small btn-inverse %%s' %% (not quantity and 'oe_hidden' or '')" t-att-data-id="product.id">Remove one</button>
+                        <button t-att-class="'btn btn-small %%s' %% (quantity and 'btn-success' or 'btn-primary')" t-att-data-id="product.id">Add to cart
+                            <span class="oe_txt">(<span class="oe_quantity"><t t-esc="quantity"/></span>)</span>
+                        </button>
+                    </t>
                 </div>
             </div>
         </div>
@@ -113,6 +143,10 @@
             <t t-set="title">Product</t>
             <t t-set="shop_content">
                 <div class="oe_product_detail">
+                    <a href="#" t-att-data-id="product.id" class="pull-right" t-if="editable">
+                        <span t-att-class="'label label-success js_unpublish %%s' %% (not product.website_published and 'hidden' or '')">Click to Unpublish</span>
+                        <span t-att-class="'label label-important js_publish %%s' %% (product.website_published and 'hidden' or '')">Click to Publish</span>
+                    </a>
                     <h1><span t-record="product" t-field="name"><t t-esc="product.name"/></span></h1>
                     <div class="oe_button_cart">
                         <button t-att-class="'btn btn-inverse %%s' %% (not quantity and 'oe_hidden' or '')" t-att-data-id="product.id">Remove one</button>