render, render_template, load, activity_schedule_with_view, get_website_pages should all be private: It should not be possible to render an aribtrary template only with its name or id Still need to render some qweb views from js so the method render_template is kept public. This explains why the website editor still need read access on ir.ui.view as we want to allow any snippet to be rendered.
29 lines
1.6 KiB
Python
29 lines
1.6 KiB
Python
# -*- coding: utf-8 -*-
|
|
# Part of Odoo. See LICENSE file for full copyright and licensing details.
|
|
from odoo import http
|
|
from odoo.http import request
|
|
|
|
from odoo.addons.sale.controllers.variant import VariantController
|
|
|
|
class WebsiteSaleVariantController(VariantController):
|
|
@http.route(['/sale/get_combination_info_website'], type='json', auth="public", methods=['POST'], website=True)
|
|
def get_combination_info_website(self, product_template_id, product_id, combination, add_qty, **kw):
|
|
"""Special route to use website logic in get_combination_info override.
|
|
This route is called in JS by appending _website to the base route.
|
|
"""
|
|
kw.pop('pricelist_id')
|
|
res = self.get_combination_info(product_template_id, product_id, combination, add_qty, request.website.get_current_pricelist(), **kw)
|
|
|
|
carousel_view = request.env['ir.ui.view']._render_template('website_sale.shop_product_carousel',
|
|
values={
|
|
'product': request.env['product.template'].browse(res['product_template_id']),
|
|
'product_variant': request.env['product.product'].browse(res['product_id']),
|
|
})
|
|
res['carousel'] = carousel_view
|
|
return res
|
|
|
|
@http.route(auth="public")
|
|
def create_product_variant(self, product_template_id, product_template_attribute_value_ids, **kwargs):
|
|
"""Override because on the website the public user must access it."""
|
|
return super(WebsiteSaleVariantController, self).create_product_variant(product_template_id, product_template_attribute_value_ids, **kwargs)
|