From e3a2448ebe36d27b562ffaf0221e89ff7ef8ad31 Mon Sep 17 00:00:00 2001 From: Xavier Morel Date: Wed, 25 Nov 2015 16:43:47 +0100 Subject: [PATCH] [ADD] form builder whitelisting: ACL check Only users who can edit the website's structure should be allowed to whitelist fields. --- addons/website_form/controllers/main.py | 1 - addons/website_form/models/models.py | 10 ++++++++-- 2 files changed, 8 insertions(+), 3 deletions(-) diff --git a/addons/website_form/controllers/main.py b/addons/website_form/controllers/main.py index 8aaa673f6ae..e5cb84823d0 100644 --- a/addons/website_form/controllers/main.py +++ b/addons/website_form/controllers/main.py @@ -15,7 +15,6 @@ class WebsiteForm(http.Controller): @http.route('/website_form/', type='http', auth="public", methods=['POST'], website=True) def website_form(self, model_name, **kwargs): model_record = request.env['ir.model'].search([('model', '=', model_name), ('website_form_access', '=', True)]) - if not model_record: return json.dumps(False) diff --git a/addons/website_form/models/models.py b/addons/website_form/models/models.py index b1a2934e3f5..c333bfe5257 100644 --- a/addons/website_form/models/models.py +++ b/addons/website_form/models/models.py @@ -89,7 +89,13 @@ class website_form_model_fields(models.Model): :param list(str) fields: list of fields to whitelist on the model :return: nothing of import """ - # todo: check access rights yo + # postgres does *not* like ``in [EMPTY TUPLE]`` queries + if not fields: return False + + # only allow users who can change the website structure + if not self.env['res.users'].has_group('base.group_website_designer'): + return False + # the ORM only allows writing on custom fields and will trigger a # registry reload once that's happened. We want to be able to # whitelist non-custom fields and the registry reload absolutely @@ -98,7 +104,7 @@ class website_form_model_fields(models.Model): "UPDATE ir_model_fields" " SET website_form_blacklisted=false" " WHERE model=%s AND name in %s", (model, tuple(fields))) - return False + return True website_form_blacklisted = fields.Boolean( 'Blacklisted in web forms', default=True, select=True, # required=True,