[SEC] rating: escape feedback, text2html to avoid js injection
[IMP] rating: website rating page: reviewed design, rate on click, update on submit [IMP] rating_project: rating_status: 'no' instead of False [IMP] rating_project/issue: smileys insteaf of thumbs for consistency in kanban [IMP] rating: allow to update an existing rating (feedback + rate) [IMP] rating: consistency on rating names (statisfied, not satisfied, higly dissatisfed) [IMP] rating: avoid deadend after rating, button to go to Odoo [IMP] rating: res_config better sentence
This commit is contained in:
Fabien Pinckaers
@@ -4,28 +4,36 @@ import werkzeug
|
||||
from openerp import http
|
||||
from openerp.http import request
|
||||
|
||||
from openerp.tools.translate import _
|
||||
|
||||
class Rating(http.Controller):
|
||||
|
||||
@http.route('/rating/<string:token>/<int:rate>', type='http', auth="public")
|
||||
def open_rating(self, token, rate, **kwargs):
|
||||
assert rate in (1, 5, 10), "Incorrect rating"
|
||||
rating = request.env['rating.rating'].sudo().search([('access_token', '=', token)])
|
||||
if not rating.consumed:
|
||||
return request.render('rating.rating_external_page_submit', {'rating': rate, 'token': token})
|
||||
else:
|
||||
return request.render('rating.rating_external_page_view', {'is_rated': True})
|
||||
if not rating:
|
||||
return request.not_found()
|
||||
rate_names={
|
||||
5: _("not satisfied"),
|
||||
1: _("highly dissatisfied"),
|
||||
10: _("satisfied")
|
||||
}
|
||||
rating.sudo().write({'rating': rate, 'consumed': True})
|
||||
return request.render('rating.rating_external_page_submit', {
|
||||
'rating': rating, 'token': token,
|
||||
'rate_name': rate_names[rate], 'rate': rate
|
||||
})
|
||||
return request.not_found()
|
||||
|
||||
@http.route(['/rating/<string:token>/<int:rate>/submit_feedback'], type="http", auth="public", method=['post'])
|
||||
def submit_rating(self, token, rate, **kwargs):
|
||||
rating = request.env['rating.rating'].sudo().search([('access_token', '=', token)])
|
||||
if not rating.consumed:
|
||||
record_sudo = request.env[rating.res_model].sudo().browse(rating.res_id)
|
||||
record_sudo.rating_apply(rate, token=token, feedback=kwargs.get('feedback'))
|
||||
# redirect to the form view if logged person
|
||||
if request.session.uid:
|
||||
return werkzeug.utils.redirect('/web#model=%s&id=%s&view_type=form' % (record_sudo._name, record_sudo.id))
|
||||
return request.render('rating.rating_external_page_view', {'is_public': True})
|
||||
else:
|
||||
return request.render('rating.rating_external_page_view', {'is_rated': True})
|
||||
return request.not_found()
|
||||
if not rating:
|
||||
return request.not_found()
|
||||
record_sudo = request.env[rating.res_model].sudo().browse(rating.res_id)
|
||||
record_sudo.rating_apply(rate, token=token, feedback=kwargs.get('feedback'))
|
||||
# redirect to the form view if logged person
|
||||
if request.session.uid:
|
||||
return werkzeug.utils.redirect('/web#model=%s&id=%s&view_type=form' % (record_sudo._name, record_sudo.id))
|
||||
return request.render('rating.rating_external_page_view')
|
||||
|
||||
@@ -1,6 +1,9 @@
|
||||
# -*- coding: utf-8 -*-
|
||||
|
||||
import uuid
|
||||
from odoo import api, fields, models
|
||||
from openerp import tools
|
||||
|
||||
|
||||
|
||||
class Rating(models.Model):
|
||||
@@ -105,22 +108,23 @@ class RatingMixin(models.AbstractModel):
|
||||
"""
|
||||
Rating, rating = self.env['rating.rating'], None
|
||||
if token:
|
||||
rating = self.env['rating.rating'].search([('access_token', '=', token), ('consumed', '=', False)], limit=1)
|
||||
rating = self.env['rating.rating'].search([('access_token', '=', token)], limit=1)
|
||||
else:
|
||||
rating = Rating.search([('res_model', '=', self._name), ('res_id', '=', self.ids[0]), ('consumed', '=', False)], limit=1)
|
||||
rating = Rating.search([('res_model', '=', self._name), ('res_id', '=', self.ids[0])], limit=1)
|
||||
if rating:
|
||||
rating.write({'rating': rate, 'feedback': feedback, 'consumed': True})
|
||||
if hasattr(self, 'message_post'):
|
||||
feedback = tools.plaintext2html(feedback or '')
|
||||
self.message_post(
|
||||
body="<img src='/rating/static/src/img/rating_%s.png' style='width:20px;height:20px'/>%s"
|
||||
% (rate, '<br/>' + feedback if feedback else ''),
|
||||
body="<img src='/rating/static/src/img/rating_%s.png' style='width:20px;height:20px;float:left;margin-right: 5px;'/>%s"
|
||||
% (rate, feedback),
|
||||
subtype=subtype or "mail.mt_comment",
|
||||
author_id=rating.partner_id and rating.partner_id.id or None # None will set the default author in mail_thread.py
|
||||
)
|
||||
if hasattr(self, 'stage_id') and self.stage_id and hasattr(self.stage_id, 'auto_validation_kanban_state') and self.stage_id.auto_validation_kanban_state:
|
||||
if rating.rating > 5:
|
||||
self.write({'kanban_state': 'done'})
|
||||
else:
|
||||
if rating.rating < 5:
|
||||
self.write({'kanban_state': 'blocked'})
|
||||
return rating
|
||||
|
||||
|
||||
@@ -101,13 +101,12 @@
|
||||
<link rel='stylesheet' href='/web/static/lib/fontawesome/css/font-awesome.css'/>
|
||||
</head>
|
||||
<div class="container">
|
||||
<div clas="row" t-if="is_rated">
|
||||
<h1 class="text-center"><i class="fa fa-frown-o fa-2x text-danger" /></h1>
|
||||
<h1 class="text-center">Sorry you have already voted!</h1>
|
||||
<div class="text-center" style="margin-top:128px">
|
||||
<i class="fa fa-check-circle fa-5x text-success" />
|
||||
</div>
|
||||
<div clas="row" t-if="is_public">
|
||||
<h1 class="text-center"><i class="fa fa-check-circle fa-2x text-success" /></h1>
|
||||
<h1 class="text-center">Thank you for submitting your feedback!</h1>
|
||||
<h2 class="text-center">We appreciate your feedback!</h2>
|
||||
<div class="text-center">
|
||||
<a href="https://www.odoo.com" class="btn btn-primary">Go to Odoo</a>
|
||||
</div>
|
||||
</div>
|
||||
</template>
|
||||
@@ -119,21 +118,24 @@
|
||||
</head>
|
||||
<div class="container">
|
||||
<div clas="row">
|
||||
<h1 class="text-center">Please submit your rating</h1>
|
||||
<h4 class="text-center">You selected <img t-attf-src='/rating/static/src/img/rating_#{rating}.png'/></h4>
|
||||
<form class="form-horizontal" t-attf-action="/rating/#{token}/#{rating}/submit_feedback" method="post">
|
||||
<div class="form-group">
|
||||
<div class="col-md-6 col-md-offset-3">
|
||||
<h5>Do you want to give additional explanation? (Optional)</h5>
|
||||
<input type="hidden" name="csrf_token" t-att-value="request.csrf_token()"/>
|
||||
<textarea class="form-control" name="feedback" rows="3"></textarea>
|
||||
</div>
|
||||
</div>
|
||||
<div class="form-group">
|
||||
<div class="col-md-6 col-md-offset-3">
|
||||
<button type="submit" class="btn btn-primary">Submit</button>
|
||||
</div>
|
||||
</div>
|
||||
<h1 class="text-center">Thanks! We appreciate your feedback.</h1>
|
||||
<h4 class="text-center text-muted" style="margin-bottom: 32px;">Your rating has been submitted.</h4>
|
||||
<div class="pull-left">
|
||||
<img t-attf-src='/rating/static/src/img/rating_#{rate}.png'/>
|
||||
</div>
|
||||
<div style="margin-left: 80px;">
|
||||
you are <b t-esc="rate_name"></b><br/>
|
||||
on our services on "<b t-esc="rating.res_name"></b>"<br/>
|
||||
<t t-if="rating.rated_partner_id">by <b t-esc="rating.rated_partner_id.name"></b>.</t>
|
||||
</div>
|
||||
<div class="clearfix"></div>
|
||||
<p style="margin-top:32px;">
|
||||
Would be great if you can provide more informaion:
|
||||
</p>
|
||||
<form class="form-horizontal" t-attf-action="/rating/#{token}/#{rate}/submit_feedback" method="post">
|
||||
<input type="hidden" name="csrf_token" t-att-value="request.csrf_token()"/>
|
||||
<textarea class="form-control" name="feedback" rows="8" t-esc="rating.feedback"></textarea>
|
||||
<button type="submit" class="btn btn-primary" style="margin-top:8px;">Send Feedback</button>
|
||||
</form>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
Reference in New Issue
Block a user