[REF] website, *: review website access rights

* event, website_event, website_forum,
* website_hr_recruitment, website_sale

Website access rights were buggy. The editor assets and website editor
assets have to be loaded together to work so the previous behavior
which only loaded one with the restricted access right was not right.
Also, people which had the "Manager" access right for model like event
or job only got access to creation and edition of those objects if they
had the full access to website access rights.

Now the website module creates the two same groups :
* group_website_publisher: load all editor assets, give access to
page creation for model the user has access (event, job, ...) and
edition of those pages
* group_website_designer: implies the first one and give access in
creation and edition of all pages + access of all website menus

The manager access rights for event, product, jobs, etc now implies
the group_website_publisher group for the user (so that the manager
have the editor assets and editor ui).
Note: some python codes use the group_website_publisher for no right
reason, this has to be adapted.

17 files changed, 76 insertions, 75 deletions

diff --git a/addons/event/security/event_security.xml b/addons/event/security/event_security.xml
index e529880a456..6605989b3fc 100644
--- a/addons/event/security/event_security.xml
+++ b/addons/event/security/event_security.xml
@@ -1,7 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <odoo>
     <data noupdate="0">
-
         <record id="group_event_user" model="res.groups">
             <field name="name">User</field>
             <field name="implied_ids" eval="[(4, ref('base.group_user'))]"/>
@@ -14,8 +13,6 @@
             <field name="implied_ids" eval="[(4, ref('group_event_user'))]"/>
             <field name="users" eval="[(4, ref('base.user_root'))]"/>
         </record>
-
-
     </data>
 
     <data noupdate="1">
diff --git a/addons/web_editor/static/src/js/editor.js b/addons/web_editor/static/src/js/editor.js
index 1163635146f..240a0a36121 100644
--- a/addons/web_editor/static/src/js/editor.js
+++ b/addons/web_editor/static/src/js/editor.js
@@ -16,7 +16,7 @@ var editor = {};
 
 editor.dummy = function () {return true;}; // used for snippets, options...
 
-editor.editable = !!$('html').data('editable');
+editor.editable = !!($('html').data('editable') || $("[data-oe-model]").length); // temporary hack, this should be done in python
 
 ajax.loadXML('/web_editor/static/src/xml/editor.xml', qweb);
 
diff --git a/addons/website/__manifest__.py b/addons/website/__manifest__.py
index 293370b1a95..aaba5cea675 100644
--- a/addons/website/__manifest__.py
+++ b/addons/website/__manifest__.py
@@ -18,8 +18,8 @@ Odoo Website CMS
     'data': [
         'data/website_data.xml',
         'data/web_planner_data.xml',
-        'security/ir.model.access.csv',
         'security/website_security.xml',
+        'security/ir.model.access.csv',
 
         'views/website_templates.xml',
         'views/website_navbar_templates.xml',
diff --git a/addons/website/data/website_data.xml b/addons/website/data/website_data.xml
index 722a1d17ca9..eaa8a006687 100644
--- a/addons/website/data/website_data.xml
+++ b/addons/website/data/website_data.xml
@@ -30,23 +30,6 @@
             <field name="website_id" ref="default_website"/>
         </record>
 
-        <record id="group_website_publisher" model="res.groups">
-            <field name="name">Editor</field>
-            <field name="category_id" ref="base.module_category_website"/>
-        </record>
-
-        <!-- Access rules to edit ir.ui.view with qWeb type -->
-        <record id="group_website_designer" model="res.groups">
-            <field name="name">Editor and Designer</field>
-            <field name="users" eval="[(4, ref('base.user_root'))]"/>
-            <field name="implied_ids" eval="[(4, ref('group_website_publisher'))]"/>
-            <field name="category_id" ref="base.module_category_website"/>
-        </record>
-
-        <record id="base.default_user" model="res.users">
-            <field name="groups_id" eval="[(4,ref('group_website_designer'))]"/>
-        </record>
-
         <record id="action_module_website" model="ir.actions.act_window">
             <field name="name">Website Apps</field>
             <field name="res_model">ir.module.module</field>
diff --git a/addons/website/security/website_security.xml b/addons/website/security/website_security.xml
index 893310ae475..2e7ad4cbe6f 100644
--- a/addons/website/security/website_security.xml
+++ b/addons/website/security/website_security.xml
@@ -1,5 +1,20 @@
 <?xml version="1.0" encoding="utf-8"?>
 <odoo>
+    <record id="group_website_publisher" model="res.groups">
+        <field name="name">Restricted Editor</field>
+        <field name="category_id" ref="base.module_category_website"/>
+    </record>
+    <record id="group_website_designer" model="res.groups">
+        <field name="name">Editor and Designer</field>
+        <field name="users" eval="[(4, ref('base.user_root'))]"/>
+        <field name="implied_ids" eval="[(4, ref('group_website_publisher'))]"/>
+        <field name="category_id" ref="base.module_category_website"/>
+    </record>
+
+    <record id="base.default_user" model="res.users">
+        <field name="groups_id" eval="[(4, ref('group_website_designer'))]"/>
+    </record>
+
     <record id="website_designer_edit_qweb" model="ir.rule">
         <field name="name">website_designer: Manage Website and qWeb view</field>
         <field name="model_id" ref="base.model_ir_ui_view"/>
diff --git a/addons/website/views/website_navbar_templates.xml b/addons/website/views/website_navbar_templates.xml
index 8ae2538ceba..43994030561 100644
--- a/addons/website/views/website_navbar_templates.xml
+++ b/addons/website/views/website_navbar_templates.xml
@@ -30,21 +30,21 @@
 
                 <div class="o_menu_brand">Website</div>
 
-                <ul class="o_menu_sections">
+                <ul class="o_menu_sections" groups="website.group_website_designer">
                     <!-- Content -->
-                    <li class="dropdown content" groups="website.group_website_publisher" t-if="editable">
+                    <li class="dropdown content" t-if="editable">
                         <a id="content-menu-button" class="dropdown-toggle waves" data-toggle="dropdown" href="#">Content</a>
                         <ul class="dropdown-menu oe_content_menu" role="menu">
-                            <li groups="website.group_website_designer">
+                            <li>
                                 <a data-action="edit_menu" href="#" title="Edit Top Menu">Edit Menu</a>
                             </li>
-                            <li t-if="deletable" groups="website.group_website_designer" role="separator" class="divider"></li>
-                            <li t-if="deletable" groups="website.group_website_designer"><a href="#" data-action="rename_page">Rename Page</a></li>
-                            <li t-if="deletable" groups="website.group_website_designer"><a href="#" data-action="delete_page">Delete Page</a></li>
+                            <li t-if="deletable" role="separator" class="divider"></li>
+                            <li t-if="deletable"><a href="#" data-action="rename_page">Rename Page</a></li>
+                            <li t-if="deletable"><a href="#" data-action="delete_page">Delete Page</a></li>
                         </ul>
                     </li>
                     <!-- Customize -->
-                    <li class="dropdown" groups="website.group_website_designer" id="customize-menu">
+                    <li class="dropdown" id="customize-menu">
                         <a class="dropdown-toggle waves" data-toggle="dropdown" href="#" id="customize-menu-button">Customize</a>
                         <ul class="dropdown-menu" role="menu">
                             <li id="html_editor"><a data-action="ace" href="#advanced-view-editor">HTML Editor</a></li>
@@ -54,7 +54,7 @@
                         </ul>
                     </li>
                     <!-- Promote -->
-                    <li class="dropdown" groups="website.group_website_designer">
+                    <li class="dropdown">
                         <a class="dropdown-toggle waves" data-toggle="dropdown" href="#" id="promote-menu-button">Promote</a>
                         <ul class="dropdown-menu oe_promote_menu" role="menu">
                             <li><a data-action="promote-current-page" href="#" title="Promote page on the web">Optimize SEO</a></li>
@@ -62,22 +62,22 @@
                     </li>
                 </ul>
 
-                <ul class="o_menu_systray hidden-xs">
+                <ul class="o_menu_systray hidden-xs" groups="website.group_website_publisher">
                     <!-- Mobile preview -->
                     <li class="o_mobile_preview">
                         <a data-action="show-mobile-preview" href="#"><span title="Mobile preview" class="fa fa-mobile"/></a>
                     </li>
                     <!-- Page Edition -->
-                    <li groups="website.group_website_publisher,website.group_website_designer">
+                    <li>
                         <a data-action="new_page" href="#" data-toggle="modal" data-target="#o_website_add_page_modal"><span class="fa fa-plus"/>New</a>
                     </li>
-                    <li t-if="not translatable" groups="website.group_website_publisher">
+                    <li t-if="not translatable">
                         <a data-action="edit" href="#"><span class="fa fa-pencil"/>Edit</a>
                     </li>
-                    <li t-if="translatable" groups="website.group_website_publisher">
+                    <li t-if="translatable">
                         <a data-action="translate" href="#">TRANSLATE</a>
                     </li>
-                    <li t-if="translatable" groups="website.group_website_publisher">
+                    <li t-if="translatable">
                         <a data-action="edit_master" href="#">or Edit Master</a>
                     </li>
                 </ul>
@@ -86,7 +86,7 @@
 
         <!-- Add new page/content modal -->
         <xpath expr="//div[@id='wrapwrap']" position="after">
-            <div groups="base.group_user" class="modal" id="o_website_add_page_modal">
+            <div groups="website.group_website_publisher" class="modal" id="o_website_add_page_modal">
                 <div class="modal-dialog modal-lg">
                     <ul>
                         <li groups="website.group_website_designer"><a href="#" data-action="new_page"><i class="fa fa-file-o"/><p>New Page</p></a></li>
diff --git a/addons/website/views/website_templates.xml b/addons/website/views/website_templates.xml
index 6f11b5be6e7..dcf2a6dc200 100644
--- a/addons/website/views/website_templates.xml
+++ b/addons/website/views/website_templates.xml
@@ -46,7 +46,6 @@
 
     <script type="text/javascript" src="/website/static/src/js/website.snippets.editor.js"></script>
     <script type="text/javascript" src="/website/static/src/js/website.snippets.gallery.js"></script>
-
 </template>
 
 <!-- Layout -->
@@ -130,14 +129,14 @@
 
             <t t-call-assets="web.assets_common" t-js="false"/>
             <t t-call-assets="web.assets_frontend" t-js="false"/>
-            <t t-call-assets="web_editor.summernote" t-js="false" groups="website.group_website_designer"/>
-            <t t-call-assets="web_editor.assets_editor" t-js="false" groups="website.group_website_designer"/>
+            <t t-call-assets="web_editor.summernote" t-js="false" groups="website.group_website_publisher"/>
+            <t t-call-assets="web_editor.assets_editor" t-js="false" groups="website.group_website_publisher"/>
             <t t-call-assets="website.assets_editor" t-js="false" groups="website.group_website_publisher"/>
 
             <t t-call-assets="web.assets_common" t-css="false"/>
             <t t-call-assets="web.assets_frontend" t-css="false"/>
-            <t t-call-assets="web_editor.summernote" t-css="false" groups="website.group_website_designer"/>
-            <t t-call-assets="web_editor.assets_editor" t-css="false" groups="website.group_website_designer"/>
+            <t t-call-assets="web_editor.summernote" t-css="false" groups="website.group_website_publisher"/>
+            <t t-call-assets="web_editor.assets_editor" t-css="false" groups="website.group_website_publisher"/>
             <t t-call-assets="website.assets_editor" t-css="false" groups="website.group_website_publisher"/>
         </t>
         <t t-set="head" t-value="head_website + (head or '')"/>
diff --git a/addons/website_event/security/website_event_security.xml b/addons/website_event/security/website_event_security.xml
index 9b735d34a95..a30ce1f6c42 100644
--- a/addons/website_event/security/website_event_security.xml
+++ b/addons/website_event/security/website_event_security.xml
@@ -10,4 +10,8 @@
         <field name="perm_create" eval="False"/>
         <field name="perm_unlink" eval="False"/>
     </record>
+
+    <record id="event.group_event_manager" model="res.groups">
+        <field name="implied_ids" eval="[(4, ref('website.group_website_publisher'))]"/>
+    </record>
 </odoo>
diff --git a/addons/website_event/views/website_event_templates.xml b/addons/website_event/views/website_event_templates.xml
index 4bdb7037363..52b75b50813 100644
--- a/addons/website_event/views/website_event_templates.xml
+++ b/addons/website_event/views/website_event_templates.xml
@@ -47,10 +47,8 @@
             <div class="row mt32 mb32">
                 <div class="col-md-9" id="middle_column">
                     <div class="text-center text-muted" t-if="not event_ids">
-                      <h1>No event found</h1>
-                      <t groups="website.group_website_publisher">
-                          <p groups="event.group_event_manager">Use the top menu <i>'Content'</i> to create your first event.</p>
-                      </t>
+                        <h1>No event found</h1>
+                        <p groups="event.group_event_manager">Use the top menu <i>'Content'</i> to create your first event.</p>
                     </div>
                     <ul class="media-list">
                         <li t-foreach="event_ids" t-as="event" class="media">
diff --git a/addons/website_forum/views/website_forum.xml b/addons/website_forum/views/website_forum.xml
index f45b5cd0c04..a6f595670d4 100644
--- a/addons/website_forum/views/website_forum.xml
+++ b/addons/website_forum/views/website_forum.xml
@@ -740,8 +740,8 @@
         <meta name="twitter:site" t-attf-content="@#{res_company.name}" />
         <meta name="twitter:title" t-att-content="question.name" />
         <meta name="twitter:description" t-att-content="question.content" />
-        <meta name="twitter:image" t-attf-content="#{request.httprequest.url_root}forum/user/#{question.create_uid.id}/avatar"/>   
-    </t> 
+        <meta name="twitter:image" t-attf-content="#{request.httprequest.url_root}forum/user/#{question.create_uid.id}/avatar"/>
+    </t>
     <t t-call="website_forum.header">
         <div class="alert alert-info text-center" role="alert" t-if="forum and question.state == 'pending' and user.karma>=forum.karma_moderate and question.active">
             <a t-attf-href="/forum/#{slug(forum)}/post/#{slug(question)}/validate" type="button" class="btn btn-success">Accept <i class="fa fa-check"/></a>
@@ -1337,7 +1337,7 @@
         <h1 class="mt0 page-header">
             <span t-field="user.name"/>
             <small>profile</small>
-            <t t-call="website.publish_management" groups="website.group_website_publisher">
+            <t t-call="website.publish_management">
                 <t t-set="object" t-value="user"/>
                 <t t-set="publish_edit" t-value="True"/>
             </t>
@@ -1515,7 +1515,7 @@
 <!-- User Navbar -->
 <template id="content_new_forum" inherit_id="website.user_navbar">
     <xpath expr="//div[@id='o_website_add_page_modal']//ul" position="inside">
-        <li groups="base.group_user"><a href="#" data-action="new_forum"><i class="fa fa-comment"/><p>New Forum</p></a></li>
+        <li groups="website.group_website_designer"><a href="#" data-action="new_forum"><i class="fa fa-comment"/><p>New Forum</p></a></li>
     </xpath>
 </template>
 
diff --git a/addons/website_hr_recruitment/security/website_hr_recruitment_security.xml b/addons/website_hr_recruitment/security/website_hr_recruitment_security.xml
index 0fb6adfcd20..61fddcd5b3c 100644
--- a/addons/website_hr_recruitment/security/website_hr_recruitment_security.xml
+++ b/addons/website_hr_recruitment/security/website_hr_recruitment_security.xml
@@ -41,5 +41,9 @@
         <field name="perm_create" eval="False"/>
         <field name="perm_unlink" eval="False"/>
     </record>
+
+    <record id="hr_recruitment.group_hr_recruitment_manager" model="res.groups">
+        <field name="implied_ids" eval="[(4, ref('website.group_website_publisher'))]"/>
+    </record>
 </data>
-</odoo>
\ No newline at end of file
+</odoo>
diff --git a/addons/website_hr_recruitment/views/website_hr_recruitment_templates.xml b/addons/website_hr_recruitment/views/website_hr_recruitment_templates.xml
index d47473ed85b..b07f36d8ce7 100644
--- a/addons/website_hr_recruitment/views/website_hr_recruitment_templates.xml
+++ b/addons/website_hr_recruitment/views/website_hr_recruitment_templates.xml
@@ -38,12 +38,10 @@
                     <div class="col-md-12" id="jobs_grid">
                         <div t-if="not jobs">
                             <div class="text-center text-muted">
-                              <h3 class="css_editable_hidden"><a t-attf-href="/page/website.contactus">Contact us</a> for job opportunities.</h3>
-                              <t groups="website.group_website_publisher">
+                                <h3 class="css_editable_hidden"><a t-attf-href="/page/website.contactus">Contact us</a> for job opportunities.</h3>
                                 <h4 groups="hr_recruitment.group_hr_recruitment_manager">
                                     Create new job pages from the <strong><i>+New</i></strong> top-right button.
                                 </h4>
-                              </t>
                             </div>
                         </div>
                         <ul class="media-list" t-if="jobs">
diff --git a/addons/website_mail_channel/views/website_mail_channel_templates.xml b/addons/website_mail_channel/views/website_mail_channel_templates.xml
index 853ab99de9e..5ed8a25e9d6 100644
--- a/addons/website_mail_channel/views/website_mail_channel_templates.xml
+++ b/addons/website_mail_channel/views/website_mail_channel_templates.xml
@@ -7,18 +7,19 @@
     </xpath>
 </template>
 
-<template id="head" inherit_id="website.assets_frontend" name="Mail Group Snippet">
-    <xpath expr="/t" position="inside">
+<template id="assets_frontend" inherit_id="website.assets_frontend">
+    <xpath expr="//link[last()]" position="after">
         <link rel="stylesheet" href="/website_mail_channel/static/src/css/website_mail_channel.css"/>
+    </xpath>
+    <xpath expr="//script[last()]" position="after">
         <script type="text/javascript" src="/website_mail_channel/static/src/js/website_mail_channel.js"/>
-
-        <script type="text/javascript" src="/website_mail_channel/static/src/js/website_mail_channel.snippet.js"></script>
+        <script type="text/javascript" src="/website_mail_channel/static/src/js/website_mail_channel.snippet.js"/>
     </xpath>
 </template>
 
-<template id="editor" inherit_id="website.assets_editor" name="Mail Group Editor">
-    <xpath expr="/t" position="inside">
-        <script type="text/javascript" src="/website_mail_channel/static/src/js/website_mail_channel.editor.js" groups="website.group_website_publisher"></script>
+<template id="assets_editor" inherit_id="website.assets_editor">
+    <xpath expr="//script[last()]" position="after">
+        <script type="text/javascript" src="/website_mail_channel/static/src/js/website_mail_channel.editor.js"/>
     </xpath>
 </template>
 
diff --git a/addons/website_mass_mailing/views/website_mass_mailing_templates.xml b/addons/website_mass_mailing/views/website_mass_mailing_templates.xml
index 4f633b8303f..52dae5c3068 100644
--- a/addons/website_mass_mailing/views/website_mass_mailing_templates.xml
+++ b/addons/website_mass_mailing/views/website_mass_mailing_templates.xml
@@ -1,16 +1,18 @@
 <?xml version="1.0" encoding="utf-8"?>
 <odoo>
 
-<template id="assets_frontend" inherit_id="website.assets_frontend" name="Mail Frontend Assets">
-    <xpath expr="." position="inside">
-        <script type="text/javascript" src="/website_mass_mailing/static/src/js/website_mass_mailing.js"/>
+<template id="assets_frontend" inherit_id="website.assets_frontend">
+    <xpath expr="//link[last()]" position="after">
         <link rel="stylesheet" href="/mass_mailing/static/src/css/mass_mailing_popup.css" type="text/css"/>
     </xpath>
+    <xpath expr="//script[last()]" position="after">
+        <script type="text/javascript" src="/website_mass_mailing/static/src/js/website_mass_mailing.js"/>
+    </xpath>
 </template>
 
-<template id="assets_editor" inherit_id="website.assets_editor" name="wesbite_mass_mailing Editor assets">
-    <xpath expr="/t" position="inside">
-        <script type="text/javascript" src="/website_mass_mailing/static/src/js/website_mass_mailing.editor.js" groups="website.group_website_publisher"/>
+<template id="assets_editor" inherit_id="website.assets_editor">
+    <xpath expr="//script[last()]" position="after">
+        <script type="text/javascript" src="/website_mass_mailing/static/src/js/website_mass_mailing.editor.js"/>
     </xpath>
 </template>
 
diff --git a/addons/website_partner/views/website_partner_templates.xml b/addons/website_partner/views/website_partner_templates.xml
index a7ee2150428..91179c77745 100644
--- a/addons/website_partner/views/website_partner_templates.xml
+++ b/addons/website_partner/views/website_partner_templates.xml
@@ -12,7 +12,7 @@
             <div class="oe_structure"/>
         </div>
     </t>
-</template> 
+</template>
 
 <template id="partner_detail" name="Partner Details">
     <t t-call="website.publish_management">
@@ -41,4 +41,4 @@
         <t t-raw="right_column or ''"/>
     </div>
 </template>
-</odoo>
\ No newline at end of file
+</odoo>
diff --git a/addons/website_sale/security/website_sale.xml b/addons/website_sale/security/website_sale.xml
index 4a129d60ece..77410d72f51 100644
--- a/addons/website_sale/security/website_sale.xml
+++ b/addons/website_sale/security/website_sale.xml
@@ -11,7 +11,7 @@
         <field name="perm_create" eval="False"/>
         <field name="perm_unlink" eval="False"/>
     </record>
-    
+
     <record id="product_supplierinfo_public" model="ir.rule">
         <field name="name">Public product supplierinfo</field>
         <field name="model_id" ref="product.model_product_supplierinfo"/>
@@ -41,5 +41,7 @@
         <field name="category_id" ref="base.module_category_hidden"/>
     </record>
 
-
+    <record id="sales_team.group_sale_manager" model="res.groups">
+        <field name="implied_ids" eval="[(4, ref('website.group_website_publisher'))]"/>
+    </record>
 </odoo>
diff --git a/addons/website_sale/views/templates.xml b/addons/website_sale/views/templates.xml
index 08176025418..ce62fbf6af4 100644
--- a/addons/website_sale/views/templates.xml
+++ b/addons/website_sale/views/templates.xml
@@ -201,9 +201,7 @@
                             <t t-if="not bins">
                                 <div class="text-center text-muted">
                                     <h3 class="css_editable_display">No product defined.</h3>
-                                    <t groups="website.group_website_publisher">
-                                        <p groups="sales_team.group_sale_manager">Click <i>'New'</i> in the top-right corner to create your first product.</p>
-                                    </t>
+                                    <p groups="sales_team.group_sale_manager">Click <i>'New'</i> in the top-right corner to create your first product.</p>
                                 </div>
                             </t>
                         </div>
@@ -1139,7 +1137,7 @@
                         <div class="col-md-9 oe_cart">
                             <div class="row">
                                 <t t-if="mode == ('new', 'billing')">
-                                    <h3 class="page-header mt16">Your Address 
+                                    <h3 class="page-header mt16">Your Address
                                         <small> or </small>
                                         <a href='/web/signup?redirect=/shop/checkout' class='btn btn-primary' style="margin-top: -11px">Sign Up</a>
                                     </h3>
@@ -1349,7 +1347,7 @@
                                     <div class="list-group">
                                         <t t-foreach='tokens' t-as='token'>
                                             <a class="list-group-item btn_payment_token" t-att-data-acquirer="token.acquirer_id.id" t-att-data-token='token.id'>
-                                                <span class="js_radio fa fa-circle-o"></span>&amp;nbsp; 
+                                                <span class="js_radio fa fa-circle-o"></span>&amp;nbsp;
                                                 <t t-esc="token.name" />
                                                 <t t-if="len(set(tokens.mapped('acquirer_id')))>1">
                                                     (<t t-esc='token.acquirer_id.name'/>)