[SEC] rating: escape feedback, text2html to avoid js injection

[IMP] rating: website rating page: reviewed design, rate on click, update on submit
[IMP] rating_project: rating_status: 'no' instead of False
[IMP] rating_project/issue: smileys insteaf of thumbs for consistency in kanban
[IMP] rating: allow to update an existing rating (feedback + rate)
[IMP] rating: consistency on rating names (statisfied, not satisfied, higly dissatisfed)
[IMP] rating: avoid deadend after rating, button to go to Odoo
[IMP] rating: res_config better sentence

4 files changed, 26 insertions, 21 deletions

diff --git a/addons/rating_project/data/project_data.xml b/addons/rating_project/data/project_data.xml
index 1332a726e39..864fbd334c3 100644
--- a/addons/rating_project/data/project_data.xml
+++ b/addons/rating_project/data/project_data.xml
@@ -57,8 +57,9 @@
                     <tr>
                         <td style="text-align:center;">
                             <h2 style="font-weight:300;font-size:18px;">
-                                Tell us how you feel about our service
+                                Tell us how you feel about our service:
                             </h2>
+                            <div style="text-color: #888888">(click on one of these smileys)</div>
                         </td>
                     </tr>
                     <tr>
@@ -67,17 +68,17 @@
                                 <tr>
                                     <td>
                                         <a href="/rating/${access_token}/10">
-                                            <img alt="Great" src="/rating/static/src/img/rating_10.png" title="It was great"/>
+                                            <img alt="Satisfied" src="/rating/static/src/img/rating_10.png" title="Satisfied"/>
                                         </a>
                                     </td>
                                     <td>
                                         <a href="/rating/${access_token}/5">
-                                            <img alt="Okay" src="/rating/static/src/img/rating_5.png" title="It was okay"/>
+                                            <img alt="Not satisfied" src="/rating/static/src/img/rating_5.png" title="Not satisfied"/>
                                         </a>
                                     </td>
                                     <td>
                                         <a href="/rating/${access_token}/1">
-                                            <img alt="Bad" src="/rating/static/src/img/rating_1.png" title="It wasn't good"/>
+                                            <img alt="Highly Dissatisfied" src="/rating/static/src/img/rating_1.png" title="Highly Dissatisfied"/>
                                         </a>
                                     </td>
                                 </tr>
@@ -96,7 +97,7 @@
                     <p>This customer survey has been sent because your task has been moved to the stage <b>${object.stage_id.name}</b></p>
                 % endif
                 % if object.project_id.rating_status == 'periodic':
-                    <p>This customer survey has been sent <b>${object.project_id.rating_status_period}</b> as long as the task is in the <b>${object.stage_id.name}</b> stage.
+                    <p>This customer survey is send <b>${object.project_id.rating_status_period}</b> as long as the task is in the <b>${object.stage_id.name}</b> stage.
                 % endif
                 <p>Email automatically sent by <a href="https://www.odoo.com/page/project-management" style="color:#a24689;text-decoration:none;">Odoo Project</a> for <a href="${object.project_id.company_id.website}" style="color:#a24689;text-decoration:none;">${object.project_id.company_id.name}</a></p>
             </td></tr>
diff --git a/addons/rating_project/models/project.py b/addons/rating_project/models/project.py
index 67b5eb02764..56bf9637ef7 100644
--- a/addons/rating_project/models/project.py
+++ b/addons/rating_project/models/project.py
@@ -78,10 +78,10 @@ class Project(models.Model):
     percentage_satisfaction_project = fields.Integer(
         compute="_compute_percentage_satisfaction_project", string="Happy % on Project", store=True, default=-1)
     rating_request_deadline = fields.Datetime(compute='_compute_rating_request_deadline', store=True)
-    rating_status = fields.Selection([('stage', 'Rating on Stage'), ('periodic', 'Periodical Rating')], 'Customer(s) Ratings', help="How to get the customer's feedbacks?\n"
-                    "- Rating on stage: Email will be sent when a task/issue is pulled in another stage\n"
+    rating_status = fields.Selection([('stage', 'Rating when changing stage'), ('periodic', 'Periodical Rating'), ('no','No rating')], 'Customer(s) Ratings', help="How to get the customer's feedbacks?\n"
+                    "- Rating when changing stage: Email will be sent when a task/issue is pulled in another stage\n"
                     "- Periodical Rating: Email will be sent periodically\n\n"
-                    "Don't forget to set up the mail templates on the stages for which you want to get the customer's feedbacks.")
+                    "Don't forget to set up the mail templates on the stages for which you want to get the customer's feedbacks.", default="no", required=True)
     rating_status_period = fields.Selection([
             ('daily', 'Daily'), ('weekly', 'Weekly'), ('bimonthly', 'Twice a Month'),
             ('monthly', 'Once a Month'), ('quarterly', 'Quarterly'), ('yearly', 'Yearly')
diff --git a/addons/rating_project/views/project_dashboard.xml b/addons/rating_project/views/project_dashboard.xml
index 1188ddd4560..50b1b516e92 100644
--- a/addons/rating_project/views/project_dashboard.xml
+++ b/addons/rating_project/views/project_dashboard.xml
@@ -10,11 +10,11 @@
             </field>
 
             <xpath expr="//div[contains(@class, 'o_kanban_primary_left')]" position="inside">
-                <div t-if="record.rating_status.raw_value" class="mt8 text-primary" title="Percentage of happy ratings over the past 30 days. Get rating details from the More menu.">
+                <div t-if="record.rating_status.raw_value != 'no'" class="mt8 text-primary" title="Percentage of happy ratings over the past 30 days. Get rating details from the More menu.">
                     <b>
                         <i class="fa fa-smile-o"/>
                         <t t-if="record.percentage_satisfaction_project.value == -1">
-                            No rating
+                            No rating yet
                         </t>
                         <t t-if="record.percentage_satisfaction_project.value != -1">
                             <t t-esc="record.percentage_satisfaction_project.value"/>%
@@ -23,7 +23,7 @@
                 </div>
             </xpath>
             <xpath expr="//div[contains(@class, 'o_kanban_card_manage_section')]" position="inside">
-                <div t-if="record.rating_status.raw_value">
+                <div t-if="record.rating_status.raw_value != 'no'">
                     <a name="action_view_all_rating" type="object">
                         Customers Ratings
                     </a>
@@ -32,4 +32,4 @@
 
         </field>
     </record>
-</odoo>
\ No newline at end of file
+</odoo>
diff --git a/addons/rating_project/views/project_view.xml b/addons/rating_project/views/project_view.xml
index 466581cbabb..d3cabb26513 100644
--- a/addons/rating_project/views/project_view.xml
+++ b/addons/rating_project/views/project_view.xml
@@ -21,6 +21,7 @@
             <field name="arch" type="xml">
                 <xpath expr="//div[@name='button_box']" position="inside">
                     <button name="%(rating_rating_action_task)d" type="action"
+                            attrs="{'invisible': [('rating_count', '=', 0)]}"
                             class="oe_stat_button" icon="fa-smile-o">
                         <field name="rating_count" string="Rating" widget="statinfo"/>
                     </button>
@@ -39,9 +40,9 @@
                 </xpath>
                 <xpath expr="//div[@class='oe_kanban_bottom_left']" position="inside">
                     <b t-if="record.rating_ids.raw_value.length">
-                        <span class="fa fa-fw mt4 fa-thumbs-up text-success" t-if="record.rating_last_value.value == 10" title="Latest Rating: Happy"/>
-                        <span class="fa fa-fw mt4 fa-thumbs-down text-warning" t-if="record.rating_last_value.value == 5" title="Latest Rating: Average"/>
-                        <span class="fa fa-fw mt4 fa-thumbs-down text-danger" t-if="record.rating_last_value.value == 1" title="Latest Rating: Not Happy"/>
+                        <span style="font-weight:bold;" class="fa fa-fw mt4 fa-smile-o text-success" t-if="record.rating_last_value.value == 10" title="Latest Rating: Satisfied"/>
+                        <span style="font-weight:bold;" class="fa fa-fw mt4 fa-meh-o text-warning" t-if="record.rating_last_value.value == 5" title="Latest Rating: Not Satisfied"/>
+                        <span style="font-weight:bold;" class="fa fa-fw mt4 fa-frown-o text-danger" t-if="record.rating_last_value.value == 1" title="Latest Rating: Higly Dissatisfied"/>
                     </b>
                 </xpath>
             </field>
@@ -56,7 +57,7 @@
             <field name="arch" type="xml">
                 <div name="button_box" position="inside">
                     <button name="action_view_task_rating"
-                        attrs="{'invisible': ['|', '|', ('rating_status', '=', False), ('use_tasks','=', False), ('percentage_satisfaction_task', '=', -1)]}"
+                        attrs="{'invisible': ['|', '|', ('rating_status', '=', 'no'), ('use_tasks','=', False), ('percentage_satisfaction_task', '=', -1)]}"
                         class="oe_stat_button oe_percent"
                         type="object"
                         icon="fa-smile-o">
@@ -66,11 +67,14 @@
                 <xpath expr="//field[@name='partner_id']" position="after">
                     <label for="rating_status"/>
                     <div>
-                        <field name="rating_status" class="oe_inline"/>
-                        <span attrs="{'invisible': [('rating_status','!=','periodic')]}"> - 
-                            <field name="rating_status_period" attrs="{'required': [('rating_status','=','periodic')]}" class="oe_inline"/>
-                        </span>
+                        <field name="rating_status" widget="radio"/>
+                        <p attrs="{'invisible': [('rating_status','not in',('periodic','stage'))]}" class="text-muted oe_edit_only">
+                            Edit project's stages and set an email template
+                            on the stages on which you want to activate the rating.
+                        </p>
                     </div>
+                    <field name="rating_status_period"  class="oe_inline"
+                        attrs="{'required': [('rating_status','=','periodic')], 'invisible': [('rating_status','!=','periodic')]}"/>
                 </xpath>
             </field>
         </record>
@@ -103,4 +107,4 @@
         <menuitem id="rating_rating_menu_project" action="rating_rating_action_project" parent="base.menu_project_report" sequence="5"/>
 
     </data>
-</openerp>
\ No newline at end of file
+</openerp>