[IMP] website: ir_actions_server: only published server action can be invoked from the front-end

bzr revid: tde@openerp.com-20140205094530-k058ealuxq9hbrdw

4 files changed, 19 insertions, 7 deletions

diff --git a/addons/website/__openerp__.py b/addons/website/__openerp__.py
index 7779686c041..4cfabd942ca 100644
--- a/addons/website/__openerp__.py
+++ b/addons/website/__openerp__.py
@@ -20,12 +20,13 @@ OpenERP Website CMS
         'views/snippets.xml',
         'views/themes.xml',
         'views/res_config.xml',
+        'views/ir_actions.xml',
     ],
     'demo': [
         'data/website_demo.xml',
     ],
     'js': ['static/src/js/website.backend.js'],
-    'qweb' : ['static/src/xml/website.backend.xml'],
+    'qweb': ['static/src/xml/website.backend.xml'],
     'css': ['static/src/css/website.backend.css'],
     'application': True,
 }
diff --git a/addons/website/controllers/main.py b/addons/website/controllers/main.py
index 9cd22a76e6e..29d2652ba94 100644
--- a/addons/website/controllers/main.py
+++ b/addons/website/controllers/main.py
@@ -374,6 +374,10 @@ class Website(openerp.addons.web.controllers.main.Home):
         cr, uid, context = request.cr, request.uid, request.context
         res, action_id, action = None, None, None
         ServerActions = request.registry['ir.actions.server']
+        # add the post values in the context, to be able to handle it
+        if context is None:
+            context = {}
+        context.get('post', {}).update(post)
 
         # find the action_id, either an int, an int into a basestring, or an xml_id
         if isinstance(id_or_xml_id, basestring) and '.' in id_or_xml_id:
@@ -389,9 +393,11 @@ class Website(openerp.addons.web.controllers.main.Home):
             action_id = action_ids and action_ids[0] or None
         # run it, return only LazyResponse that are templates to be rendered
         if action_id:
-            action_res = ServerActions.run(cr, uid, [action_id], context=context)
-            if isinstance(action_res, LazyResponse):
-                res = action_res
+            action = ServerActions.browse(cr, uid, action_id, context=context)
+            if action.state == 'code' and action.website_published:
+                action_res = ServerActions.run(cr, uid, [action_id], context=context)
+                if isinstance(action_res, LazyResponse):
+                    res = action_res
         if res:
             return res
         return request.redirect('/')
diff --git a/addons/website/data/website_data.xml b/addons/website/data/website_data.xml
index dc50a494a49..85476c8f7fe 100644
--- a/addons/website/data/website_data.xml
+++ b/addons/website/data/website_data.xml
@@ -8,6 +8,7 @@
         <record id="action_website_test" model="ir.actions.server">
             <field name="name">Website Test</field>
             <field name="condition">True</field>
+            <field name="website_published" eval="True"/>
             <field name="model_id" ref="base.model_res_partner"/>
             <field name="code">
 values = {}
diff --git a/addons/website/models/ir_actions.py b/addons/website/models/ir_actions.py
index c6b71e51e1e..e47c3496f31 100644
--- a/addons/website/models/ir_actions.py
+++ b/addons/website/models/ir_actions.py
@@ -9,9 +9,13 @@ class actions_server(osv.Model):
     _name = 'ir.actions.server'
     _inherit = ['ir.actions.server']
 
-    # _columns = {
-    #     'website': fields.boolean('Website Stuff'),
-    # }
+    _columns = {
+        'website_published': fields.boolean(
+            'Available on the Website',
+            help='A Code server action can be run using a dedicated controller. Set'
+                 'this field as True to allow users to run this action. If it is False'
+                 'the action cannot be run through the dedicated controller.'),
+    }
 
     def _get_eval_context(self, cr, uid, action, context=None):
         eval_context = super(actions_server, self)._get_eval_context(cr, uid, action, context=context)