[IMP] website: remove employee visibility level

You can use has_group(employee) instead

+ fix enumerate_page: when you search a page with visibility constraints,
you never seen it even if force was set to True.

task-2091365 again

closes odoo/odoo#41483

X-original-commit: f1c7a34f0b8276895c18ca6c450a142f9a815e3b
Signed-off-by: Jérémy Kersten (jke) <jke@openerp.com>

5 files changed, 45 insertions, 38 deletions

diff --git a/addons/website/models/ir_ui_view.py b/addons/website/models/ir_ui_view.py
index 89e4889e879..3618c0a141c 100644
--- a/addons/website/models/ir_ui_view.py
+++ b/addons/website/models/ir_ui_view.py
@@ -4,9 +4,8 @@
 import logging
 import werkzeug
 import uuid
-from itertools import groupby
 
-from odoo import api, fields, models, _
+from odoo import api, fields, models
 from odoo import tools
 from odoo.addons.http_routing.models.ir_http import url_for
 from odoo.osv import expression
@@ -25,9 +24,9 @@ class View(models.Model):
     page_ids = fields.One2many('website.page', 'view_id')
     first_page_id = fields.Many2one('website.page', string='Website Page', help='First page linked to this view', compute='_compute_first_page_id')
     track = fields.Boolean(string='Track', default=False, help="Allow to specify for one page of the website to be trackable or not")
-    visibility = fields.Selection([('', 'All'), ('connected', 'Connected'), ('restricted_group', 'Restricted Group'), ('password', 'With Password'), ('employee', 'Internal Users')], default='')
+    visibility = fields.Selection([('', 'All'), ('connected', 'Signed In'), ('restricted_group', 'Restricted Group'), ('password', 'With Password')], default='')
     visibility_group = fields.Many2one('res.groups')
-    visibility_password = fields.Char(groups='base.group_system')
+    visibility_password = fields.Char(groups='website.group_website_publisher')
 
     def _compute_first_page_id(self):
         for view in self:
@@ -314,22 +313,22 @@ class View(models.Model):
 
     def handle_visibility(self, do_raise=True):
         """ Check the visibility set on the main view and raise 403 if you should not have access.
-            Order is: Public, Connected, Has group, Password, Employee
-            An user type can see all previous type. So an employee can see password page withtout
-            know the password.
+            Order is: Public, Connected, Has group, Password
 
-            It only check the visibility on the main content, others views called stay available in
-            rpc or via other way.
+            It only check the visibility on the main content, others views called stay available in rpc.
         """
         error = False
         self = self.sudo()
         if self.visibility and not request.env.user.has_group('website.group_website_designer'):
-            if (self.visibility == 'connected' and request.website.is_public_user()) or \
-               (self.visibility == 'employee' and request.env.user.share) or \
-               (self.visibility == 'restricted_group' and request.env.user.share and self.visibility_group and
-                    request.env.user.id not in self.visibility_group.sudo().users.ids):
+            if (self.visibility == 'connected' and request.website.is_public_user()):
                 error = werkzeug.exceptions.Forbidden()
-            elif self.visibility == 'password' and request.env.user.share and (request.website.is_public_user() or self.id not in request.session.get('views_unlock', [])):
+            elif self.visibility == 'restricted_group' and self.visibility_group:
+                # special case, to avoid employee.user_ids
+                if (self.visibility_group.get_external_id() == 'base.group_user' and not request.env.user.share) or \
+                        request.env.user.id not in self.visibility_group.sudo().users.ids:
+                    error = werkzeug.exceptions.Forbidden()
+            elif self.visibility == 'password' and \
+                    (request.website.is_public_user() or self.id not in request.session.get('views_unlock', [])):
                 if self.sudo().visibility_password == request.params.get('visibility_password'):
                     request.session.setdefault('views_unlock', list()).append(self.id)
                 else:
diff --git a/addons/website/models/website.py b/addons/website/models/website.py
index 9dd2c8c9be1..df542be4b29 100644
--- a/addons/website/models/website.py
+++ b/addons/website/models/website.py
@@ -769,11 +769,14 @@ class Website(models.Model):
                     yield page
 
         # '/' already has a http.route & is in the routing_map so it will already have an entry in the xml
-        domain = [('url', '!=', '/'), ('visibility', '=', False)]
+        domain = [('url', '!=', '/')]
         if not force:
-            domain += [('website_indexed', '=', True)]
+            domain += [('website_indexed', '=', True), ('visibility', '=', False)]
             # is_visible
-            domain += [('website_published', '=', True), '|', ('date_publish', '=', False), ('date_publish', '<=', fields.Datetime.now())]
+            domain += [
+                ('website_published', '=', True), ('visibility', '=', False),
+                '|', ('date_publish', '=', False), ('date_publish', '<=', fields.Datetime.now())
+            ]
 
         if query_string:
             domain += [('url', 'like', query_string)]
diff --git a/addons/website/models/website_page.py b/addons/website/models/website_page.py
index 2595d053982..95a98a308ee 100644
--- a/addons/website/models/website_page.py
+++ b/addons/website/models/website_page.py
@@ -62,6 +62,16 @@ class Page(models.Model):
         """ Get identifier of this page view that may be used to render it """
         return self.view_id.id
 
+    def get_page_properties(self):
+        self.ensure_one()
+        res = self.read([
+            'id', 'name', 'url', 'website_published', 'website_indexed', 'date_publish',
+            'menu_ids', 'is_homepage', 'website_id', 'visibility', 'visibility_password', 'visibility_group'
+        ])[0]
+        if not res['visibility_group']:
+            res['visibility_group'] = self.env.ref('base.group_user').name_get()[0]
+        return res
+
     @api.model
     def save_page_info(self, website_id, data):
         website = self.env['website'].browse(website_id)
diff --git a/addons/website/static/src/js/menu/content.js b/addons/website/static/src/js/menu/content.js
index 0de22ca0059..3fe01322745 100644
--- a/addons/website/static/src/js/menu/content.js
+++ b/addons/website/static/src/js/menu/content.js
@@ -79,15 +79,11 @@ var PagePropertiesDialog = weWidgets.Dialog.extend({
 
         defs.push(this._rpc({
             model: 'website.page',
-            method: 'read',
-            args: [
-                this.page_id,
-                ['id', 'name', 'url', 'website_published', 'website_indexed', 'date_publish',
-                'menu_ids', 'is_homepage', 'website_id', 'visibility', 'visibility_password', 'visibility_group']
-            ],
+            method: 'get_page_properties',
+            args: [this.page_id],
         }).then(function (page) {
-            page[0].url = _.str.startsWith(page[0].url, '/') ? page[0].url.substring(1) : page[0].url;
-            self.page = page[0];
+            page.url = _.str.startsWith(page.url, '/') ? page.url.substring(1) : page.url;
+            self.page = page;
         }));
 
         return Promise.all(defs);
@@ -206,13 +202,13 @@ var PagePropertiesDialog = weWidgets.Dialog.extend({
         });
         var url = this.$('#page_url').val();
 
-        var $date_publish = this.$("#date_publish");
-        $date_publish.closest(".form-group").removeClass('o_has_error').find('.form-control, .custom-select').removeClass('is-invalid');
-        var date_publish = $date_publish.val();
-        if (date_publish !== "") {
-            date_publish = this._parse_date(date_publish);
-            if (!date_publish) {
-                $date_publish.closest(".form-group").addClass('o_has_error').find('.form-control, .custom-select').addClass('is-invalid');
+        var $datePublish = this.$("#date_publish");
+        $datePublish.closest(".form-group").removeClass('o_has_error').find('.form-control, .custom-select').removeClass('is-invalid');
+        var datePublish = $datePublish.val();
+        if (datePublish !== "") {
+            datePublish = this._parse_date(datePublish);
+            if (!datePublish) {
+                $datePublish.closest(".form-group").addClass('o_has_error').find('.form-control, .custom-select').addClass('is-invalid');
                 return;
             }
         }
@@ -228,9 +224,9 @@ var PagePropertiesDialog = weWidgets.Dialog.extend({
             redirect_type: this.$('#redirect_type').val(),
             website_indexed: this.$('#is_indexed').prop('checked'),
             visibility: this.$('#visibility').val(),
-            visibility_password: this.$('#visibility_password').val(),
-            visibility_group: this.$('#visibility_group').data('group-id'),
-            date_publish: date_publish,
+            visibility_password: this.$('#visibility').val() === 'password' ? this.$('#visibility_password').val() : false,
+            visibility_group: this.$('#visibility').val() === 'restricted_group' ? this.$('#visibility_group').data('group-id') : false,
+            date_publish: datePublish,
         };
         this._rpc({
             model: 'website.page',
diff --git a/addons/website/static/src/xml/website.pageProperties.xml b/addons/website/static/src/xml/website.pageProperties.xml
index 2a10cd3ed77..f1e891a5be0 100644
--- a/addons/website/static/src/xml/website.pageProperties.xml
+++ b/addons/website/static/src/xml/website.pageProperties.xml
@@ -145,10 +145,9 @@
                         <div class="input-group">
                             <select id="visibility" class="form-control col-md-4">
                                 <option value="" t-att-selected="widget.page.visibility == ''">Public</option>
-                                <option value="connected" t-att-selected="widget.page.visibility == 'connected' ? 'selected' : undefined">Connected</option>
-                                <option value="restricted_group" t-att-selected="widget.page.visibility == 'restricted_group' ? 'selected' : undefined">Has Group</option>
+                                <option value="connected" t-att-selected="widget.page.visibility == 'connected' ? 'selected' : undefined">Signed In</option>
+                                <option value="restricted_group" t-att-selected="widget.page.visibility == 'restricted_group' ? 'selected' : undefined">Some Users</option>
                                 <option value="password" t-att-selected="widget.page.visibility == 'password' ? 'selected' : undefined">Password</option>
-                                <option value="employee" t-att-selected="widget.page.visibility == 'employee' ? 'selected' : undefined">Internal users</option>
                             </select>
                             <div class="ml-1 input-group-prepend show_visibility_password" >
                                 <div class="input-group-text"><i class="fa fa-key"></i></div>