From e6e07ec1a3d8c5b9c64dac053f45d808b29fca28 Mon Sep 17 00:00:00 2001 From: Jeremy Kersten Date: Mon, 23 Apr 2018 15:03:39 +0200 Subject: [PATCH] [FIX] website_slide: avoid traceback when channel not readable If the user has limited_access, download_security field was not read due to the override of check_field_access_rights and so the field not set. When you try to access/read it, you got: Selection is not iterable. Now we check in sudo the download_security. We also add the **kw that should be present in all routes. Avoid: "slide_download() got an unexpected keyword argument 'debug'" We also remove this controller from the sitemap. --- addons/website_slides/controllers/main.py | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/addons/website_slides/controllers/main.py b/addons/website_slides/controllers/main.py index ba0b1305946..2ef722104b5 100644 --- a/addons/website_slides/controllers/main.py +++ b/addons/website_slides/controllers/main.py @@ -179,8 +179,9 @@ class WebsiteSlides(http.Controller): response.mimetype = 'application/pdf' return response - @http.route('''/slides/slide//download''', type='http', auth="public", website=True) - def slide_download(self, slide, sitemap=False): + @http.route('''/slides/slide//download''', type='http', auth="public", website=True, sitemap=False) + def slide_download(self, slide, **kw): + slide = slide.sudo() if slide.download_security == 'public' or (slide.download_security == 'user' and request.session.uid): filecontent = base64.b64decode(slide.datas) disposition = 'attachment; filename=%s.pdf' % werkzeug.urls.url_quote(slide.name) @@ -190,7 +191,7 @@ class WebsiteSlides(http.Controller): ('Content-Length', len(filecontent)), ('Content-Disposition', disposition)]) elif not request.session.uid and slide.download_security == 'user': - return werkzeug.utils.redirect('/web?redirect=/slides/slide/%s' % (slide.id)) + return request.redirect('/web/login?redirect=/slides/slide/%s' % (slide.id)) return request.render("website.403") @http.route('''/slides/slide//promote''', type='http', auth='user', website=True)