[imp]:improve access rule or auth=public

bzr revid: sunilsharma.sharma07@gmail.com-20140324132032-e4rpxzufwsuirzm0

3 files changed, 24 insertions, 7 deletions

diff --git a/addons/website_forum/controllers/main.py b/addons/website_forum/controllers/main.py
index 86145ae8add..bee857a1743 100644
--- a/addons/website_forum/controllers/main.py
+++ b/addons/website_forum/controllers/main.py
@@ -32,6 +32,7 @@ from openerp.addons.web.http import request
 from dateutil.relativedelta import relativedelta
 from openerp.addons.website.controllers.main import Website as controllers
 from openerp.addons.website.models.website import slug
+from openerp.addons.web.controllers.main import login_redirect
 
 controllers = controllers()
 
@@ -131,6 +132,8 @@ class website_forum(http.Controller):
 
     @http.route(['/forum/<model("website.forum"):forum>/ask'], type='http', auth="public", website=True, multilang=True)
     def question_ask(self, forum, **post):
+        if not request.session.uid:
+            return login_redirect()
         values = {
             'searches': {},
             'forum': forum,
@@ -158,6 +161,8 @@ class website_forum(http.Controller):
 
     @http.route(['/forum/<model("website.forum"):forum>/comment'], type='http', auth="public", methods=['POST'], website=True)
     def post_comment(self, forum, post_id, **kwargs):
+        if not request.session.uid:
+            return login_redirect()
         cr, uid, context = request.cr, request.uid, request.context
         if kwargs.get('comment'):
             user = request.registry['res.users'].browse(cr, SUPERUSER_ID, uid, context=context)
@@ -242,6 +247,7 @@ class website_forum(http.Controller):
     @http.route('/forum/<model("website.forum"):forum>/question/ask/', type='http', auth="user", multilang=True, methods=['POST'], website=True)
     def register_question(self, forum, **question):
         cr, uid, context = request.cr, request.uid, request.context
+        
         create_context = dict(context)
         new_question_id = request.registry['website.forum.post'].create(
             request.cr, request.uid, {
@@ -255,8 +261,10 @@ class website_forum(http.Controller):
             }, context=create_context)
         return werkzeug.utils.redirect("/forum/%s/question/%s" % (slug(forum),new_question_id))
 
-    @http.route('/forum/<model("website.forum"):forum>/question/postanswer/', type='http', auth="user", multilang=True, methods=['POST'], website=True)
-    def post_answer(self, forum, post_id, **question):
+    @http.route('/forum/<model("website.forum"):forum>/question/postanswer/', type='http', auth="public", multilang=True, methods=['POST'], website=True)
+    def post_answer(self, forum ,post_id, **question):
+        if not request.session.uid:
+            return login_redirect()
         cr, uid, context = request.cr, request.uid, request.context
         request.registry['res.users'].write(cr, uid, uid, {'forum': True}, context=context)
 
@@ -392,8 +400,10 @@ class website_forum(http.Controller):
         request.registry['website.forum.post'].unlink(request.cr, request.uid, [int(kwarg.get('post_id'))], context=request.context)
         return True
 
-    @http.route('/forum/<model("website.forum"):forum>/delete/question/<model("website.forum.post"):post>', type='http', auth="user", multilang=True, website=True)
+    @http.route('/forum/<model("website.forum"):forum>/delete/question/<model("website.forum.post"):post>', type='http', auth="public", multilang=True, website=True)
     def delete_question(self, forum, post, **kwarg):
+        if not request.session.uid:
+            return login_redirect()
         #instead of unlink record just change 'active' to false so user can undelete it.
         request.registry['website.forum.post'].write( request.cr, request.uid, [post.id], {
             'active': False,
@@ -412,8 +422,10 @@ class website_forum(http.Controller):
         request.registry['mail.message'].unlink(request.cr, request.uid, [int(kwarg.get('message_id'))], context=request.context)
         return True
 
-    @http.route('/forum/<model("website.forum"):forum>/edit/question/<model("website.forum.post"):post>', type='http', auth="user", multilang=True, website=True)
+    @http.route('/forum/<model("website.forum"):forum>/edit/question/<model("website.forum.post"):post>', type='http', auth="public", multilang=True, website=True)
     def edit_question(self, forum, post, **kwarg):
+        if not request.session.uid:
+            return login_redirect()
         values = {
             'post': post,
             'forum': forum,
@@ -459,8 +471,10 @@ class website_forum(http.Controller):
             }, context=context)
         return correct
 
-    @http.route('/forum/<model("website.forum"):forum>/close/question/<model("website.forum.post"):post>', type='http', auth="user", multilang=True, website=True)
+    @http.route('/forum/<model("website.forum"):forum>/close/question/<model("website.forum.post"):post>', type='http', auth="public", multilang=True, website=True)
     def close_question(self, forum, post, **kwarg):
+        if not request.session.uid:
+            return login_redirect()
         cr, uid, context = request.cr, request.uid, request.context
         Reason = request.registry['website.forum.post.reason']
         reason_ids = Reason.search(cr, uid, [], context=context)
@@ -487,6 +501,8 @@ class website_forum(http.Controller):
 
     @http.route('/forum/<model("website.forum"):forum>/reopen/question/<model("website.forum.post"):post>', type='http', auth="user", multilang=True, website=True)
     def reopen(self, forum, post, **kwarg):
+        if not request.session.uid:
+            return login_redirect()
         request.registry['website.forum.post'].write( request.cr, request.uid, [post.id], {
             'state': 'active',
         }, context=request.context)
diff --git a/addons/website_forum/security/ir.model.access.csv b/addons/website_forum/security/ir.model.access.csv
index 5039147b6db..4eaa46fc4e4 100644
--- a/addons/website_forum/security/ir.model.access.csv
+++ b/addons/website_forum/security/ir.model.access.csv
@@ -6,4 +6,5 @@ access_website_forum_post_history,website.forum.post.history,model_website_forum
 access_website_forum_post_vote,website.forum.post.vote,model_website_forum_post_vote,base.group_public,1,0,0,0
 access_website_forum_post_reason,website.forum.post.reason,model_website_forum_post_reason,base.group_public,1,0,0,0
 access_website_forum_tag,website.forum.tag,model_website_forum_tag,base.group_public,1,0,0,0
-
+access_gamification_badge_user,gamification.badge.user,gamification.model_gamification_badge_user,base.group_public,1,0,0,0
+access_gamification_badge,gamification_badge,gamification.model_gamification_badge,base.group_public,1,0,0,0
diff --git a/addons/website_forum/static/src/js/website_forum.editor.js b/addons/website_forum/static/src/js/website_forum.editor.js
index 485cf6f41ef..426c5a9ecc1 100644
--- a/addons/website_forum/static/src/js/website_forum.editor.js
+++ b/addons/website_forum/static/src/js/website_forum.editor.js
@@ -43,7 +43,7 @@ $(document).ready(function () {
                 if (data == false){
                     vote_alert = $link.parents().find("#vote_alert");
                     if (vote_alert.length <= 1) {
-                        var $warning = $('<div class="alert alert-danger alert-dismissable" id="vote_alert" style="position: fixed; margin-top: -75px;">'+
+                        var $warning = $('<div class="alert alert-danger alert-dismissable" id="vote_alert" style="position:absolute; margin-top: -30px; margin-left: 90px;">'+
                             '<button type="button" class="close notification_close" data-dismiss="alert" aria-hidden="true">&times;</button>'+
                             'Sorry, you cannot vote for your own posts'+
                             '</div>');