From 57469dc81c67bf752e1376dd2a5c9a75bf024d7c Mon Sep 17 00:00:00 2001 From: "Sunil Sharma (OpenERP)" Date: Mon, 24 Mar 2014 18:50:32 +0530 Subject: [PATCH] [imp]:improve access rule or auth=public bzr revid: sunilsharma.sharma07@gmail.com-20140324132032-e4rpxzufwsuirzm0 --- addons/website_forum/controllers/main.py | 26 +++++++++++++++---- .../security/ir.model.access.csv | 3 ++- .../static/src/js/website_forum.editor.js | 2 +- 3 files changed, 24 insertions(+), 7 deletions(-) diff --git a/addons/website_forum/controllers/main.py b/addons/website_forum/controllers/main.py index 86145ae8add..bee857a1743 100644 --- a/addons/website_forum/controllers/main.py +++ b/addons/website_forum/controllers/main.py @@ -32,6 +32,7 @@ from openerp.addons.web.http import request from dateutil.relativedelta import relativedelta from openerp.addons.website.controllers.main import Website as controllers from openerp.addons.website.models.website import slug +from openerp.addons.web.controllers.main import login_redirect controllers = controllers() @@ -131,6 +132,8 @@ class website_forum(http.Controller): @http.route(['/forum//ask'], type='http', auth="public", website=True, multilang=True) def question_ask(self, forum, **post): + if not request.session.uid: + return login_redirect() values = { 'searches': {}, 'forum': forum, @@ -158,6 +161,8 @@ class website_forum(http.Controller): @http.route(['/forum//comment'], type='http', auth="public", methods=['POST'], website=True) def post_comment(self, forum, post_id, **kwargs): + if not request.session.uid: + return login_redirect() cr, uid, context = request.cr, request.uid, request.context if kwargs.get('comment'): user = request.registry['res.users'].browse(cr, SUPERUSER_ID, uid, context=context) @@ -242,6 +247,7 @@ class website_forum(http.Controller): @http.route('/forum//question/ask/', type='http', auth="user", multilang=True, methods=['POST'], website=True) def register_question(self, forum, **question): cr, uid, context = request.cr, request.uid, request.context + create_context = dict(context) new_question_id = request.registry['website.forum.post'].create( request.cr, request.uid, { @@ -255,8 +261,10 @@ class website_forum(http.Controller): }, context=create_context) return werkzeug.utils.redirect("/forum/%s/question/%s" % (slug(forum),new_question_id)) - @http.route('/forum//question/postanswer/', type='http', auth="user", multilang=True, methods=['POST'], website=True) - def post_answer(self, forum, post_id, **question): + @http.route('/forum//question/postanswer/', type='http', auth="public", multilang=True, methods=['POST'], website=True) + def post_answer(self, forum ,post_id, **question): + if not request.session.uid: + return login_redirect() cr, uid, context = request.cr, request.uid, request.context request.registry['res.users'].write(cr, uid, uid, {'forum': True}, context=context) @@ -392,8 +400,10 @@ class website_forum(http.Controller): request.registry['website.forum.post'].unlink(request.cr, request.uid, [int(kwarg.get('post_id'))], context=request.context) return True - @http.route('/forum//delete/question/', type='http', auth="user", multilang=True, website=True) + @http.route('/forum//delete/question/', type='http', auth="public", multilang=True, website=True) def delete_question(self, forum, post, **kwarg): + if not request.session.uid: + return login_redirect() #instead of unlink record just change 'active' to false so user can undelete it. request.registry['website.forum.post'].write( request.cr, request.uid, [post.id], { 'active': False, @@ -412,8 +422,10 @@ class website_forum(http.Controller): request.registry['mail.message'].unlink(request.cr, request.uid, [int(kwarg.get('message_id'))], context=request.context) return True - @http.route('/forum//edit/question/', type='http', auth="user", multilang=True, website=True) + @http.route('/forum//edit/question/', type='http', auth="public", multilang=True, website=True) def edit_question(self, forum, post, **kwarg): + if not request.session.uid: + return login_redirect() values = { 'post': post, 'forum': forum, @@ -459,8 +471,10 @@ class website_forum(http.Controller): }, context=context) return correct - @http.route('/forum//close/question/', type='http', auth="user", multilang=True, website=True) + @http.route('/forum//close/question/', type='http', auth="public", multilang=True, website=True) def close_question(self, forum, post, **kwarg): + if not request.session.uid: + return login_redirect() cr, uid, context = request.cr, request.uid, request.context Reason = request.registry['website.forum.post.reason'] reason_ids = Reason.search(cr, uid, [], context=context) @@ -487,6 +501,8 @@ class website_forum(http.Controller): @http.route('/forum//reopen/question/', type='http', auth="user", multilang=True, website=True) def reopen(self, forum, post, **kwarg): + if not request.session.uid: + return login_redirect() request.registry['website.forum.post'].write( request.cr, request.uid, [post.id], { 'state': 'active', }, context=request.context) diff --git a/addons/website_forum/security/ir.model.access.csv b/addons/website_forum/security/ir.model.access.csv index 5039147b6db..4eaa46fc4e4 100644 --- a/addons/website_forum/security/ir.model.access.csv +++ b/addons/website_forum/security/ir.model.access.csv @@ -6,4 +6,5 @@ access_website_forum_post_history,website.forum.post.history,model_website_forum access_website_forum_post_vote,website.forum.post.vote,model_website_forum_post_vote,base.group_public,1,0,0,0 access_website_forum_post_reason,website.forum.post.reason,model_website_forum_post_reason,base.group_public,1,0,0,0 access_website_forum_tag,website.forum.tag,model_website_forum_tag,base.group_public,1,0,0,0 - +access_gamification_badge_user,gamification.badge.user,gamification.model_gamification_badge_user,base.group_public,1,0,0,0 +access_gamification_badge,gamification_badge,gamification.model_gamification_badge,base.group_public,1,0,0,0 diff --git a/addons/website_forum/static/src/js/website_forum.editor.js b/addons/website_forum/static/src/js/website_forum.editor.js index 485cf6f41ef..426c5a9ecc1 100644 --- a/addons/website_forum/static/src/js/website_forum.editor.js +++ b/addons/website_forum/static/src/js/website_forum.editor.js @@ -43,7 +43,7 @@ $(document).ready(function () { if (data == false){ vote_alert = $link.parents().find("#vote_alert"); if (vote_alert.length <= 1) { - var $warning = $('
'+ + var $warning = $('
'+ ''+ 'Sorry, you cannot vote for your own posts'+ '
');