diff options
| author | Thibault Delavallée <tde@odoo.com> | 2018-10-19 10:46:26 +0000 |
|---|---|---|
| committer | Thibault Delavallée <tde@odoo.com> | 2019-01-14 10:34:21 +0000 |
| commit | 75638ffb94fa4ae1753f733d8cb6f7f58f0b6a0a (patch) | |
| tree | 76f8d0e34cf9d201e2a0f284bb17163fa82e5324 /addons/link_tracker | |
| parent | 9ee9724a10fc5e835d8d42da0e9e83fe687848d8 (diff) | |
[REF] link_tracker: do not let public read technical / private link data
Link tracker models are rather technical and should not be accessed as it is
by external people. Let us delegate control to controllers and lessen a bit
model accessibility.
Currently everyone can use add_click method and generate statistics. Now
statistics will be generated only through dedicated routes. It will make
statistics more reliable and ensure technical data remain private.
Next commit will update code from controllers and main methods in order to be
have a more readable click API and avoid link between non dependent modules.
This commit is linked to task ID 1904277 and PR #28242.
Diffstat (limited to 'addons/link_tracker')
| -rw-r--r-- | addons/link_tracker/controller/main.py | 2 | ||||
| -rw-r--r-- | addons/link_tracker/security/ir.model.access.csv | 15 |
2 files changed, 10 insertions, 7 deletions
diff --git a/addons/link_tracker/controller/main.py b/addons/link_tracker/controller/main.py index c03cbf56813..3b23c005446 100644 --- a/addons/link_tracker/controller/main.py +++ b/addons/link_tracker/controller/main.py @@ -11,6 +11,6 @@ class LinkTracker(http.Controller): @http.route('/r/<string:code>', type='http', auth='none', website=True) def full_url_redirect(self, code, **post): country_code = request.session.geoip and request.session.geoip.get('country_code') or False - request.env['link.tracker.click'].add_click(code, request.httprequest.remote_addr, country_code, stat_id=False) + request.env['link.tracker.click'].sudo().add_click(code, request.httprequest.remote_addr, country_code, stat_id=False) redirect_url = request.env['link.tracker'].get_url_from_code(code) return werkzeug.utils.redirect(redirect_url or '', 301) diff --git a/addons/link_tracker/security/ir.model.access.csv b/addons/link_tracker/security/ir.model.access.csv index ac6c710496c..ed484dc5731 100644 --- a/addons/link_tracker/security/ir.model.access.csv +++ b/addons/link_tracker/security/ir.model.access.csv @@ -1,7 +1,10 @@ id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink -access_link_tracker_user,link.tracker,model_link_tracker,base.group_user,1,0,0,0 -access_link_tracker_public,link.tracker,model_link_tracker,base.group_public,1,0,0,0 -access_link_tracker_code_user,link.tracker.code,model_link_tracker_code,base.group_user,1,0,0,0 -access_link_tracker_code_public,link.tracker.code,model_link_tracker_code,base.group_public,1,0,0,0 -access_link_tracker_click_user,link.tracker.click,model_link_tracker_click,base.group_user,1,0,0,0 -access_link_tracker_click_public,link.tracker.click,model_link_tracker_click,base.group_public,1,0,0,0 +access_link_tracker_user,access.link.tracker.user,model_link_tracker,base.group_user,1,0,0,0 +access_link_tracker_public,access.link.tracker.public,model_link_tracker,base.group_public,0,0,0,0 +access_link_tracker_system,access.link.tracker.system,model_link_tracker,base.group_system,1,1,1,1 +access_link_tracker_code_user,access.link.tracker.code.user,model_link_tracker_code,base.group_user,1,0,0,0 +access_link_tracker_code_public,access.link.tracker.code.public,model_link_tracker_code,base.group_public,0,0,0,0 +access_link_tracker_code_system,access.link.tracker.code.system,model_link_tracker_code,base.group_system,1,1,1,1 +access_link_tracker_click_user,access.link.tracker.click.user,model_link_tracker_click,base.group_user,1,0,0,0 +access_link_tracker_click_public,access.link.tracker.click.public,model_link_tracker_click,base.group_public,0,0,0,0 +access_link_tracker_click_system,access.link.tracker.click.system,model_link_tracker_click,base.group_system,1,1,1,1 |