std-odoo
cc012a0864
Purpose ======= Purpose of this commit is to add a new group for the mail template designer. Goal is to make roles clearer: managers edit templates, users use them. This commit allow some designers / managers to make email template and to let others users use those email templates. Specifications ============== When this feature is enabled in the Settings page, a new group is required to modify email templates in a composer like wizard or to make dynamic content. This allows to separate managers editing / composing templates from standard users that use them. If the current does not have this group, the email body will be in readonly mode if he selected an email template. That way we force him to use the email template that the manager made. Technical ========= New Group --------- Only users in this group will be able to create / write email template or to write Jinja code in the mail composer (including other fields like subject in mailing). By default, all internal users have this group. Mass mailing users also have this group as writing mailings is about the same management level as writing templates. Mail Composer Mixin ------------------- In comment mode, the template is rendered and then saved on the body field so non-"Mail Template Editor" users can load email templates. But in mass mode, the body of the template is saved and then rendered and many things change the body (HTML sanitizer, web editor move inline CSS properties, add / remove spaces...). So in this case, we can not know if the user changed the body or not. That is why we put the body field in readonly mode so, it is not modified by the web editor. Jinja code detection -------------------- To detect dynamic Jinja content, we compile the template, and we browse the AST. If we do not have a single "Template Data" node, we assume that the template is dynamic. When we detect the template as static, we do not render it. That way we avoid unnecessary rendering. Code cleaning ------------- Move Jinja import into tools so that it is outside of mail framework code. Task-2187263 closes odoo/odoo#75840 Related: odoo/enterprise#20547 Signed-off-by: Thibault Delavallee (tde) <tde@openerp.com>
109 lines
4.8 KiB
Python
109 lines
4.8 KiB
Python
# -*- coding: utf-8 -*-
|
|
# Part of Odoo. See LICENSE file for full copyright and licensing details.
|
|
|
|
from odoo.tests.common import TransactionCase, users
|
|
from odoo.addons.mail.tests.common import mail_new_test_user
|
|
from odoo.exceptions import AccessError
|
|
from odoo.tests import tagged
|
|
from odoo.tools import mute_logger
|
|
|
|
|
|
@tagged('post_install')
|
|
class TestSmsTemplateAccessRights(TransactionCase):
|
|
|
|
@classmethod
|
|
def setUpClass(cls):
|
|
super().setUpClass()
|
|
cls.user_admin = mail_new_test_user(cls.env, login='user_system', groups='base.group_user,base.group_system')
|
|
cls.basic_user = mail_new_test_user(cls.env, login='user_employee', groups='base.group_user')
|
|
sms_enabled_models = cls.env['ir.model'].search([('is_mail_thread', '=', True), ('transient', '=', False)])
|
|
vals = []
|
|
for model in sms_enabled_models:
|
|
vals.append({
|
|
'name': 'SMS Template ' + model.name,
|
|
'body': 'Body Test',
|
|
'model_id': model.id,
|
|
})
|
|
cls.sms_templates = cls.env['sms.template'].create(vals)
|
|
|
|
cls.sms_dynamic_template = cls.env['sms.template'].sudo().create({
|
|
'body': '${object.name}',
|
|
'model_id': cls.env['ir.model'].sudo().search([('model', '=', 'res.partner')]).id,
|
|
})
|
|
|
|
cls.partner = cls.env['res.partner'].create({'name': 'Test Partner'})
|
|
|
|
@users('user_employee')
|
|
@mute_logger('odoo.models.unlink')
|
|
def test_access_rights_user(self):
|
|
# Check if a member of group_user can only read on sms.template
|
|
for sms_template in self.env['sms.template'].browse(self.sms_templates.ids):
|
|
self.assertTrue(bool(sms_template.name))
|
|
with self.assertRaises(AccessError):
|
|
sms_template.write({'name': 'Update Template'})
|
|
with self.assertRaises(AccessError):
|
|
self.env['sms.template'].create({
|
|
'name': 'New SMS Template ' + sms_template.model_id.name,
|
|
'body': 'Body Test',
|
|
'model_id': sms_template.model_id.id,
|
|
})
|
|
with self.assertRaises(AccessError):
|
|
sms_template.unlink()
|
|
|
|
@users('user_system')
|
|
@mute_logger('odoo.models.unlink', 'odoo.addons.base.models.ir_model')
|
|
def test_access_rights_system(self):
|
|
admin = self.env.ref('base.user_admin')
|
|
for sms_template in self.env['sms.template'].browse(self.sms_templates.ids):
|
|
self.assertTrue(bool(sms_template.name))
|
|
sms_template.write({'body': 'New body from admin'})
|
|
self.env['sms.template'].create({
|
|
'name': 'New SMS Template ' + sms_template.model_id.name,
|
|
'body': 'Body Test',
|
|
'model_id': sms_template.model_id.id,
|
|
})
|
|
|
|
# check admin is allowed to read all templates since he can be a member of
|
|
# other groups applying restrictions based on the model
|
|
self.assertTrue(bool(self.env['sms.template'].with_user(admin).browse(sms_template.ids).name))
|
|
|
|
sms_template.unlink()
|
|
|
|
@users('user_employee')
|
|
def test_sms_template_rendering_restricted(self):
|
|
self.env['ir.config_parameter'].sudo().set_param('mail.restrict.template.rendering', True)
|
|
self.basic_user.groups_id -= self.env.ref('mail.group_mail_template_editor')
|
|
|
|
sms_composer = self.env['sms.composer'].create({
|
|
'composition_mode': 'comment',
|
|
'template_id': self.sms_dynamic_template.id,
|
|
'res_id': self.partner.id,
|
|
'res_model': 'res.partner',
|
|
})
|
|
|
|
self.assertEqual(sms_composer.body, self.partner.name, 'Simple user should be able to render SMS template')
|
|
|
|
sms_composer.composition_mode = 'mass'
|
|
self.assertEqual(sms_composer.body, '${object.name}', 'In mass mode, we should not render the template')
|
|
|
|
body = sms_composer._prepare_body_values(self.partner)[self.partner.id]
|
|
self.assertEqual(body, self.partner.name, 'In mass mode, if the user did not change the body, he should be able to render it')
|
|
|
|
sms_composer.body = 'New body: ${4 + 9}'
|
|
with self.assertRaises(AccessError, msg='User should not be able to write new Jinja code'):
|
|
sms_composer._prepare_body_values(self.partner)
|
|
|
|
@users('user_system')
|
|
def test_sms_template_rendering_unrestricted(self):
|
|
self.env['ir.config_parameter'].sudo().set_param('mail.restrict.template.rendering', True)
|
|
|
|
sms_composer = self.env['sms.composer'].create({
|
|
'composition_mode': 'comment',
|
|
'template_id': self.sms_dynamic_template.id,
|
|
'res_id': self.partner.id,
|
|
'res_model': 'res.partner',
|
|
})
|
|
|
|
body = sms_composer._prepare_body_values(self.partner)[self.partner.id]
|
|
self.assertIn(self.partner.name, body, 'Template Editor should be able to write new Jinja code')
|