pengyuthon/odoo_source
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[SEC] rating: escape feedback, text2html to avoid js injection

Browse Source 
[IMP] rating: website rating page: reviewed design, rate on click, update on submit
[IMP] rating_project: rating_status: 'no' instead of False
[IMP] rating_project/issue: smileys insteaf of thumbs for consistency in kanban
[IMP] rating: allow to update an existing rating (feedback + rate)
[IMP] rating: consistency on rating names (statisfied, not satisfied, higly dissatisfed)
[IMP] rating: avoid deadend after rating, button to go to Odoo
[IMP] rating: res_config better sentence
This commit is contained in:
Fabien Pinckaers
2016-07-02 18:33:55 +02:00
parent 580129522f
commit fb289e0b5d
11 changed files with 88 additions and 69 deletions
Download Patch File Download Diff File Expand all files Collapse all files
addons/rating/controllers/main.py
+22 -14
View File
@@ -4,28 +4,36 @@ import werkzeug
from openerp import http
from openerp.http import request
from openerp.tools.translate import _
class Rating(http.Controller):
@http.route('/rating/<string:token>/<int:rate>', type='http', auth="public")
def open_rating(self, token, rate, **kwargs):
assert rate in (1, 5, 10), "Incorrect rating"
rating = request.env['rating.rating'].sudo().search([('access_token', '=', token)])
if not rating.consumed:
return request.render('rating.rating_external_page_submit', {'rating': rate, 'token': token})
else:
return request.render('rating.rating_external_page_view', {'is_rated': True})
if not rating:
return request.not_found()
rate_names={
5: _("not satisfied"),
1: _("highly dissatisfied"),
10: _("satisfied")
}
rating.sudo().write({'rating': rate, 'consumed': True})
return request.render('rating.rating_external_page_submit', {
'rating': rating, 'token': token,
'rate_name': rate_names[rate], 'rate': rate
})
return request.not_found()
@http.route(['/rating/<string:token>/<int:rate>/submit_feedback'], type="http", auth="public", method=['post'])
def submit_rating(self, token, rate, **kwargs):
rating = request.env['rating.rating'].sudo().search([('access_token', '=', token)])
if not rating.consumed:
record_sudo = request.env[rating.res_model].sudo().browse(rating.res_id)
record_sudo.rating_apply(rate, token=token, feedback=kwargs.get('feedback'))
# redirect to the form view if logged person
if request.session.uid:
return werkzeug.utils.redirect('/web#model=%s&id=%s&view_type=form' % (record_sudo._name, record_sudo.id))
return request.render('rating.rating_external_page_view', {'is_public': True})
else:
return request.render('rating.rating_external_page_view', {'is_rated': True})
return request.not_found()
if not rating:
return request.not_found()
record_sudo = request.env[rating.res_model].sudo().browse(rating.res_id)
record_sudo.rating_apply(rate, token=token, feedback=kwargs.get('feedback'))
# redirect to the form view if logged person
if request.session.uid:
return werkzeug.utils.redirect('/web#model=%s&id=%s&view_type=form' % (record_sudo._name, record_sudo.id))
return request.render('rating.rating_external_page_view')