In rating/controllers/main.py, the method action_submit_rating accepts
only post request. This creates a problem when you're trying to use the
web editor on the template as well as when you just paste the url in
your browser, for those are get request. The current behavior is a crash
with 'method not allowed'. This commit's purpose is to change the method
so it also accept get request. The use case of editing the feedback
rating page is arguable but it schould not crash.
The behavior after this commit is that the web editor is enable for the
page, and relaoding the page does not crash anymore.
task-3047893
closesodoo/odoo#105985
X-original-commit: 1b61faad8281d8b8d2fa1bf526f2ae2c4c8ba07b
Signed-off-by: Laurent Stukkens (ltu) <ltu@odoo.com>
PURPOSE
Rating model should be available only for internal users. External users
access them only through dedicated routes or controllers using sudo and/or
granting access through tokens. Therefore simplifying ACLs should be feasible.
SPECIFICATIONS
Remove access to rating.rating for public and portal users. Only employees
can access it, with full access given to system admins.
Update various functional flows to use sudo() and check that access is
verified before using sudo.
Impacted modules
* rating / mail: add groups on some rating related fields as only
internal users should access them now;
* rating / mail: set some statistics fields using compute_sudo as their
value should be accessible for external people even without access to
the underlying rating.rating records;
* project: makes some use of rating and has to be updated, notably for
the public rating page;
* website_{livechat, rating, slides}: add sudo in public routes as access
is already granted;
* website_slides: set statistics field using compute_sudo as their
value should be accessible for external people;
TASK ID 2053096
PR #36592
Signed-off-by: Thibault Delavallee (tde) <tde@openerp.com>
damr