pengyuthon/odoo_source
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[SEC] rating: escape feedback, text2html to avoid js injection

Browse Source 
[IMP] rating: website rating page: reviewed design, rate on click, update on submit
[IMP] rating_project: rating_status: 'no' instead of False
[IMP] rating_project/issue: smileys insteaf of thumbs for consistency in kanban
[IMP] rating: allow to update an existing rating (feedback + rate)
[IMP] rating: consistency on rating names (statisfied, not satisfied, higly dissatisfed)
[IMP] rating: avoid deadend after rating, button to go to Odoo
[IMP] rating: res_config better sentence
This commit is contained in:
Fabien Pinckaers
2016-07-02 18:33:55 +02:00
parent 580129522f
commit fb289e0b5d
11 changed files with 88 additions and 69 deletions
Download Patch File Download Diff File Expand all files Collapse all files
addons/rating_project/data/project_data.xml
+6 -5
View File
@@ -57,8 +57,9 @@
<tr>
<td style="text-align:center;">
<h2 style="font-weight:300;font-size:18px;">
Tell us how you feel about our service
Tell us how you feel about our service:
</h2>
<div style="text-color: #888888">(click on one of these smileys)</div>
</td>
</tr>
<tr>
@@ -67,17 +68,17 @@
<tr>
<td>
<a href="/rating/${access_token}/10">
<img alt="Great" src="/rating/static/src/img/rating_10.png" title="It was great"/>
<img alt="Satisfied" src="/rating/static/src/img/rating_10.png" title="Satisfied"/>
</a>
</td>
<td>
<a href="/rating/${access_token}/5">
<img alt="Okay" src="/rating/static/src/img/rating_5.png" title="It was okay"/>
<img alt="Not satisfied" src="/rating/static/src/img/rating_5.png" title="Not satisfied"/>
</a>
</td>
<td>
<a href="/rating/${access_token}/1">
<img alt="Bad" src="/rating/static/src/img/rating_1.png" title="It wasn't good"/>
<img alt="Highly Dissatisfied" src="/rating/static/src/img/rating_1.png" title="Highly Dissatisfied"/>
</a>
</td>
</tr>
@@ -96,7 +97,7 @@
<p>This customer survey has been sent because your task has been moved to the stage <b>${object.stage_id.name}</b></p>
% endif
% if object.project_id.rating_status == 'periodic':
<p>This customer survey has been sent <b>${object.project_id.rating_status_period}</b> as long as the task is in the <b>${object.stage_id.name}</b> stage.
<p>This customer survey is send <b>${object.project_id.rating_status_period}</b> as long as the task is in the <b>${object.stage_id.name}</b> stage.
% endif
<p>Email automatically sent by <a href="https://www.odoo.com/page/project-management" style="color:#a24689;text-decoration:none;">Odoo Project</a> for <a href="${object.project_id.company_id.website}" style="color:#a24689;text-decoration:none;">${object.project_id.company_id.name}</a></p>
</td></tr>
addons/rating_project/models/project.py
+3 -3
View File
@@ -78,10 +78,10 @@ class Project(models.Model):
percentage_satisfaction_project = fields.Integer(
compute="_compute_percentage_satisfaction_project", string="Happy % on Project", store=True, default=-1)
rating_request_deadline = fields.Datetime(compute='_compute_rating_request_deadline', store=True)
rating_status = fields.Selection([('stage', 'Rating on Stage'), ('periodic', 'Periodical Rating')], 'Customer(s) Ratings', help="How to get the customer's feedbacks?\n"
"- Rating on stage: Email will be sent when a task/issue is pulled in another stage\n"
rating_status = fields.Selection([('stage', 'Rating when changing stage'), ('periodic', 'Periodical Rating'), ('no','No rating')], 'Customer(s) Ratings', help="How to get the customer's feedbacks?\n"
"- Rating when changing stage: Email will be sent when a task/issue is pulled in another stage\n"
"- Periodical Rating: Email will be sent periodically\n\n"
"Don't forget to set up the mail templates on the stages for which you want to get the customer's feedbacks.")
"Don't forget to set up the mail templates on the stages for which you want to get the customer's feedbacks.", default="no", required=True)
rating_status_period = fields.Selection([
('daily', 'Daily'), ('weekly', 'Weekly'), ('bimonthly', 'Twice a Month'),
('monthly', 'Once a Month'), ('quarterly', 'Quarterly'), ('yearly', 'Yearly')
addons/rating_project/views/project_dashboard.xml
+4 -4
View File
@@ -10,11 +10,11 @@
</field>
<xpath expr="//div[contains(@class, 'o_kanban_primary_left')]" position="inside">
<div t-if="record.rating_status.raw_value" class="mt8 text-primary" title="Percentage of happy ratings over the past 30 days. Get rating details from the More menu.">
<div t-if="record.rating_status.raw_value != 'no'" class="mt8 text-primary" title="Percentage of happy ratings over the past 30 days. Get rating details from the More menu.">
<b>
<i class="fa fa-smile-o"/>
<t t-if="record.percentage_satisfaction_project.value == -1">
No rating
No rating yet
</t>
<t t-if="record.percentage_satisfaction_project.value != -1">
<t t-esc="record.percentage_satisfaction_project.value"/>%
@@ -23,7 +23,7 @@
</div>
</xpath>
<xpath expr="//div[contains(@class, 'o_kanban_card_manage_section')]" position="inside">
<div t-if="record.rating_status.raw_value">
<div t-if="record.rating_status.raw_value != 'no'">
<a name="action_view_all_rating" type="object">
Customers Ratings
</a>
@@ -32,4 +32,4 @@
</field>
</record>
</odoo>
</odoo>
addons/rating_project/views/project_view.xml
+13 -9
View File
@@ -21,6 +21,7 @@
<field name="arch" type="xml">
<xpath expr="//div[@name='button_box']" position="inside">
<button name="%(rating_rating_action_task)d" type="action"
attrs="{'invisible': [('rating_count', '=', 0)]}"
class="oe_stat_button" icon="fa-smile-o">
<field name="rating_count" string="Rating" widget="statinfo"/>
</button>
@@ -39,9 +40,9 @@
</xpath>
<xpath expr="//div[@class='oe_kanban_bottom_left']" position="inside">
<b t-if="record.rating_ids.raw_value.length">
<span class="fa fa-fw mt4 fa-thumbs-up text-success" t-if="record.rating_last_value.value == 10" title="Latest Rating: Happy"/>
<span class="fa fa-fw mt4 fa-thumbs-down text-warning" t-if="record.rating_last_value.value == 5" title="Latest Rating: Average"/>
<span class="fa fa-fw mt4 fa-thumbs-down text-danger" t-if="record.rating_last_value.value == 1" title="Latest Rating: Not Happy"/>
<span style="font-weight:bold;" class="fa fa-fw mt4 fa-smile-o text-success" t-if="record.rating_last_value.value == 10" title="Latest Rating: Satisfied"/>
<span style="font-weight:bold;" class="fa fa-fw mt4 fa-meh-o text-warning" t-if="record.rating_last_value.value == 5" title="Latest Rating: Not Satisfied"/>
<span style="font-weight:bold;" class="fa fa-fw mt4 fa-frown-o text-danger" t-if="record.rating_last_value.value == 1" title="Latest Rating: Higly Dissatisfied"/>
</b>
</xpath>
</field>
@@ -56,7 +57,7 @@
<field name="arch" type="xml">
<div name="button_box" position="inside">
<button name="action_view_task_rating"
attrs="{'invisible': ['|', '|', ('rating_status', '=', False), ('use_tasks','=', False), ('percentage_satisfaction_task', '=', -1)]}"
attrs="{'invisible': ['|', '|', ('rating_status', '=', 'no'), ('use_tasks','=', False), ('percentage_satisfaction_task', '=', -1)]}"
class="oe_stat_button oe_percent"
type="object"
icon="fa-smile-o">
@@ -66,11 +67,14 @@
<xpath expr="//field[@name='partner_id']" position="after">
<label for="rating_status"/>
<div>
<field name="rating_status" class="oe_inline"/>
<span attrs="{'invisible': [('rating_status','!=','periodic')]}"> -
<field name="rating_status_period" attrs="{'required': [('rating_status','=','periodic')]}" class="oe_inline"/>
</span>
<field name="rating_status" widget="radio"/>
<p attrs="{'invisible': [('rating_status','not in',('periodic','stage'))]}" class="text-muted oe_edit_only">
Edit project's stages and set an email template
on the stages on which you want to activate the rating.
</p>
</div>
<field name="rating_status_period" class="oe_inline"
attrs="{'required': [('rating_status','=','periodic')], 'invisible': [('rating_status','!=','periodic')]}"/>
</xpath>
</field>
</record>
@@ -103,4 +107,4 @@
<menuitem id="rating_rating_menu_project" action="rating_rating_action_project" parent="base.menu_project_report" sequence="5"/>
</data>
</openerp>
</openerp>