[SEC] rating: escape feedback, text2html to avoid js injection

[IMP] rating: website rating page: reviewed design, rate on click, update on submit
[IMP] rating_project: rating_status: 'no' instead of False
[IMP] rating_project/issue: smileys insteaf of thumbs for consistency in kanban
[IMP] rating: allow to update an existing rating (feedback + rate)
[IMP] rating: consistency on rating names (statisfied, not satisfied, higly dissatisfed)
[IMP] rating: avoid deadend after rating, button to go to Odoo
[IMP] rating: res_config better sentence

3 files changed, 54 insertions, 40 deletions

diff --git a/addons/rating/controllers/main.py b/addons/rating/controllers/main.py
index ed05f8d372c..5833b4633a8 100644
--- a/addons/rating/controllers/main.py
+++ b/addons/rating/controllers/main.py
@@ -4,28 +4,36 @@ import werkzeug
 from openerp import http
 from openerp.http import request
 
+from openerp.tools.translate import _
 
 class Rating(http.Controller):
 
     @http.route('/rating/<string:token>/<int:rate>', type='http', auth="public")
     def open_rating(self, token, rate, **kwargs):
+        assert rate in (1, 5, 10), "Incorrect rating"
         rating = request.env['rating.rating'].sudo().search([('access_token', '=', token)])
-        if not rating.consumed:
-            return request.render('rating.rating_external_page_submit', {'rating': rate, 'token': token})
-        else:
-            return request.render('rating.rating_external_page_view', {'is_rated': True})
+        if not rating:
+            return request.not_found()
+        rate_names={
+            5: _("not satisfied"),
+            1: _("highly dissatisfied"),
+            10: _("satisfied")
+        }
+        rating.sudo().write({'rating': rate, 'consumed': True})
+        return request.render('rating.rating_external_page_submit', {
+            'rating': rating, 'token': token,
+            'rate_name': rate_names[rate], 'rate': rate
+        })
         return request.not_found()
 
     @http.route(['/rating/<string:token>/<int:rate>/submit_feedback'], type="http", auth="public", method=['post'])
     def submit_rating(self, token, rate, **kwargs):
         rating = request.env['rating.rating'].sudo().search([('access_token', '=', token)])
-        if not rating.consumed:
-            record_sudo = request.env[rating.res_model].sudo().browse(rating.res_id)
-            record_sudo.rating_apply(rate, token=token, feedback=kwargs.get('feedback'))
-            # redirect to the form view if logged person
-            if request.session.uid:
-                return werkzeug.utils.redirect('/web#model=%s&id=%s&view_type=form' % (record_sudo._name, record_sudo.id))
-            return request.render('rating.rating_external_page_view', {'is_public': True})
-        else:
-            return request.render('rating.rating_external_page_view', {'is_rated': True})
-        return request.not_found()
+        if not rating:
+            return request.not_found()
+        record_sudo = request.env[rating.res_model].sudo().browse(rating.res_id)
+        record_sudo.rating_apply(rate, token=token, feedback=kwargs.get('feedback'))
+        # redirect to the form view if logged person
+        if request.session.uid:
+            return werkzeug.utils.redirect('/web#model=%s&id=%s&view_type=form' % (record_sudo._name, record_sudo.id))
+        return request.render('rating.rating_external_page_view')
diff --git a/addons/rating/models/rating.py b/addons/rating/models/rating.py
index a723d2514e5..9c87139d380 100644
--- a/addons/rating/models/rating.py
+++ b/addons/rating/models/rating.py
@@ -1,6 +1,9 @@
 # -*- coding: utf-8 -*-
+
 import uuid
 from odoo import api, fields, models
+from openerp import tools
+
 
 
 class Rating(models.Model):
@@ -105,22 +108,23 @@ class RatingMixin(models.AbstractModel):
         """
         Rating, rating = self.env['rating.rating'], None
         if token:
-            rating = self.env['rating.rating'].search([('access_token', '=', token), ('consumed', '=', False)], limit=1)
+            rating = self.env['rating.rating'].search([('access_token', '=', token)], limit=1)
         else:
-            rating = Rating.search([('res_model', '=', self._name), ('res_id', '=', self.ids[0]), ('consumed', '=', False)], limit=1)
+            rating = Rating.search([('res_model', '=', self._name), ('res_id', '=', self.ids[0])], limit=1)
         if rating:
             rating.write({'rating': rate, 'feedback': feedback, 'consumed': True})
             if hasattr(self, 'message_post'):
+                feedback = tools.plaintext2html(feedback or '')
                 self.message_post(
-                    body="<img src='/rating/static/src/img/rating_%s.png' style='width:20px;height:20px'/>%s"
-                    % (rate, '<br/>' + feedback if feedback else ''),
+                    body="<img src='/rating/static/src/img/rating_%s.png' style='width:20px;height:20px;float:left;margin-right: 5px;'/>%s"
+                    % (rate, feedback),
                     subtype=subtype or "mail.mt_comment",
                     author_id=rating.partner_id and rating.partner_id.id or None  # None will set the default author in mail_thread.py
                 )
             if hasattr(self, 'stage_id') and self.stage_id and hasattr(self.stage_id, 'auto_validation_kanban_state') and self.stage_id.auto_validation_kanban_state:
                 if rating.rating > 5:
                     self.write({'kanban_state': 'done'})
-                else:
+                if rating.rating < 5:
                     self.write({'kanban_state': 'blocked'})
         return rating
 
diff --git a/addons/rating/views/rating_template.xml b/addons/rating/views/rating_template.xml
index a3f6a4424b9..77c1bf6cb51 100644
--- a/addons/rating/views/rating_template.xml
+++ b/addons/rating/views/rating_template.xml
@@ -101,13 +101,12 @@
                 <link rel='stylesheet' href='/web/static/lib/fontawesome/css/font-awesome.css'/>
             </head>
             <div class="container">
-                <div clas="row" t-if="is_rated">
-                    <h1 class="text-center"><i class="fa fa-frown-o fa-2x text-danger" /></h1>
-                    <h1 class="text-center">Sorry you have already voted!</h1>
+                <div class="text-center" style="margin-top:128px">
+                    <i class="fa fa-check-circle fa-5x text-success" />
                 </div>
-                <div clas="row" t-if="is_public">
-                    <h1 class="text-center"><i class="fa fa-check-circle fa-2x text-success" /></h1>
-                    <h1 class="text-center">Thank you for submitting your feedback!</h1>
+                <h2 class="text-center">We appreciate your feedback!</h2>
+                <div class="text-center">
+                    <a href="https://www.odoo.com" class="btn btn-primary">Go to Odoo</a>
                 </div>
             </div>
         </template>
@@ -119,21 +118,24 @@
             </head>
             <div class="container">
                 <div clas="row">
-                    <h1 class="text-center">Please submit your rating</h1>
-                    <h4 class="text-center">You selected <img t-attf-src='/rating/static/src/img/rating_#{rating}.png'/></h4>
-                    <form class="form-horizontal" t-attf-action="/rating/#{token}/#{rating}/submit_feedback" method="post">
-                        <div class="form-group">
-                            <div class="col-md-6 col-md-offset-3">
-                                <h5>Do you want to give additional explanation? (Optional)</h5>
-                                <input type="hidden" name="csrf_token" t-att-value="request.csrf_token()"/>
-                                <textarea class="form-control" name="feedback" rows="3"></textarea>
-                            </div>
-                        </div>
-                        <div class="form-group">
-                            <div class="col-md-6 col-md-offset-3">
-                                <button type="submit" class="btn btn-primary">Submit</button>
-                            </div>
-                        </div>
+                    <h1 class="text-center">Thanks! We appreciate your feedback.</h1>
+                    <h4 class="text-center text-muted" style="margin-bottom: 32px;">Your rating has been submitted.</h4>
+                    <div class="pull-left">
+                        <img t-attf-src='/rating/static/src/img/rating_#{rate}.png'/>
+                    </div>
+                    <div style="margin-left: 80px;">
+                        you are <b t-esc="rate_name"></b><br/>
+                        on our services on "<b t-esc="rating.res_name"></b>"<br/>
+                        <t t-if="rating.rated_partner_id">by <b t-esc="rating.rated_partner_id.name"></b>.</t>
+                    </div>
+                    <div class="clearfix"></div>
+                    <p style="margin-top:32px;">
+                        Would be great if you can provide more informaion:
+                    </p>
+                    <form class="form-horizontal" t-attf-action="/rating/#{token}/#{rate}/submit_feedback" method="post">
+                        <input type="hidden" name="csrf_token" t-att-value="request.csrf_token()"/>
+                        <textarea class="form-control" name="feedback" rows="8" t-esc="rating.feedback"></textarea>
+                        <button type="submit" class="btn btn-primary" style="margin-top:8px;">Send Feedback</button>
                     </form>
                 </div>
             </div>