[SEC] rating: escape feedback, text2html to avoid js injection

[IMP] rating: website rating page: reviewed design, rate on click, update on submit
[IMP] rating_project: rating_status: 'no' instead of False
[IMP] rating_project/issue: smileys insteaf of thumbs for consistency in kanban
[IMP] rating: allow to update an existing rating (feedback + rate)
[IMP] rating: consistency on rating names (statisfied, not satisfied, higly dissatisfed)
[IMP] rating: avoid deadend after rating, button to go to Odoo
[IMP] rating: res_config better sentence

1 files changed, 22 insertions, 14 deletions

diff --git a/addons/rating/controllers/main.py b/addons/rating/controllers/main.py
index ed05f8d372c..5833b4633a8 100644
--- a/addons/rating/controllers/main.py
+++ b/addons/rating/controllers/main.py
@@ -4,28 +4,36 @@ import werkzeug
 from openerp import http
 from openerp.http import request
 
+from openerp.tools.translate import _
 
 class Rating(http.Controller):
 
     @http.route('/rating/<string:token>/<int:rate>', type='http', auth="public")
     def open_rating(self, token, rate, **kwargs):
+        assert rate in (1, 5, 10), "Incorrect rating"
         rating = request.env['rating.rating'].sudo().search([('access_token', '=', token)])
-        if not rating.consumed:
-            return request.render('rating.rating_external_page_submit', {'rating': rate, 'token': token})
-        else:
-            return request.render('rating.rating_external_page_view', {'is_rated': True})
+        if not rating:
+            return request.not_found()
+        rate_names={
+            5: _("not satisfied"),
+            1: _("highly dissatisfied"),
+            10: _("satisfied")
+        }
+        rating.sudo().write({'rating': rate, 'consumed': True})
+        return request.render('rating.rating_external_page_submit', {
+            'rating': rating, 'token': token,
+            'rate_name': rate_names[rate], 'rate': rate
+        })
         return request.not_found()
 
     @http.route(['/rating/<string:token>/<int:rate>/submit_feedback'], type="http", auth="public", method=['post'])
     def submit_rating(self, token, rate, **kwargs):
         rating = request.env['rating.rating'].sudo().search([('access_token', '=', token)])
-        if not rating.consumed:
-            record_sudo = request.env[rating.res_model].sudo().browse(rating.res_id)
-            record_sudo.rating_apply(rate, token=token, feedback=kwargs.get('feedback'))
-            # redirect to the form view if logged person
-            if request.session.uid:
-                return werkzeug.utils.redirect('/web#model=%s&id=%s&view_type=form' % (record_sudo._name, record_sudo.id))
-            return request.render('rating.rating_external_page_view', {'is_public': True})
-        else:
-            return request.render('rating.rating_external_page_view', {'is_rated': True})
-        return request.not_found()
+        if not rating:
+            return request.not_found()
+        record_sudo = request.env[rating.res_model].sudo().browse(rating.res_id)
+        record_sudo.rating_apply(rate, token=token, feedback=kwargs.get('feedback'))
+        # redirect to the form view if logged person
+        if request.session.uid:
+            return werkzeug.utils.redirect('/web#model=%s&id=%s&view_type=form' % (record_sudo._name, record_sudo.id))
+        return request.render('rating.rating_external_page_view')