From de5be74db5d18c005551d24e9cf6e4e335cc278f Mon Sep 17 00:00:00 2001 From: fw-bot Date: Tue, 1 Jun 2021 14:16:46 +0000 Subject: [PATCH] [FIX] website_slides: allow to use only in POST This method only expects to be called as POST and should not be called with GET. This commit enforces that. [CLA] Signature for sushiwushi closes odoo/odoo#71575 X-original-commit: 00f2eeee7aa514599b40e049be46eacdcc8332fa Signed-off-by: Martin Trigaux (mat) --- addons/website_slides/controllers/mail.py | 2 +- addons/website_slides/controllers/main.py | 2 +- doc/cla/individual/sushiwushi.md | 11 +++++++++++ 3 files changed, 13 insertions(+), 2 deletions(-) create mode 100644 doc/cla/individual/sushiwushi.md diff --git a/addons/website_slides/controllers/mail.py b/addons/website_slides/controllers/mail.py index b1875fd6469..8c72322e290 100644 --- a/addons/website_slides/controllers/mail.py +++ b/addons/website_slides/controllers/mail.py @@ -33,7 +33,7 @@ class SlidesPortalChatter(PortalChatter): @http.route([ '/slides/mail/update_comment', '/mail/chatter_update', - ], type='json', auth="user") + ], type='json', auth="user", methods=['POST']) def mail_update_message(self, res_model, res_id, message, message_id, attachment_ids=None, attachment_tokens=None, **post): # keep this mechanism intern to slide currently (saas 12.5) as it is # considered experimental diff --git a/addons/website_slides/controllers/main.py b/addons/website_slides/controllers/main.py index 83bf0a4ebf4..12a712f361a 100644 --- a/addons/website_slides/controllers/main.py +++ b/addons/website_slides/controllers/main.py @@ -1031,7 +1031,7 @@ class WebsiteSlides(WebsiteProfile): 'can_create': can_create, } - @http.route('/slides/category/add', type="http", website=True, auth="user") + @http.route('/slides/category/add', type="http", website=True, auth="user", methods=['POST']) def slide_category_add(self, channel_id, name): """ Adds a category to the specified channel. Slide is added at the end of slide list based on sequence. """ diff --git a/doc/cla/individual/sushiwushi.md b/doc/cla/individual/sushiwushi.md new file mode 100644 index 00000000000..4993e0237e3 --- /dev/null +++ b/doc/cla/individual/sushiwushi.md @@ -0,0 +1,11 @@ +Malaysia, 2021-06-01 + +I hereby agree to the terms of the Odoo Individual Contributor License +Agreement v1.0. + +I declare that I am authorized and able to make this agreement and sign this +declaration. + +Signed, + +iamsushi 45194995+sushiwushi@users.noreply.github.com https://github.com/sushiwushi