[IMP] prevent edition of page if groups which current user doesn't have

If the current view uses @groups attributes (possibly in called templates),
the corresponding elements are rendered to a void (empty string in qweb). If
said user can edit the page, does so and saves a view section in which there's
a @groups to which he has no access, the element[@groups] is completely
removed from the template once saved, losing it.

If QWeb encounters an @groups to which the current user has no right during
rendering, have it request a no-RTE page, so the user can not RTE-edit the
page (or drop snippets in it).

1 files changed, 12 insertions, 0 deletions

diff --git a/addons/website/static/src/js/website.editor.js b/addons/website/static/src/js/website.editor.js
index fcb957cafda..f8d1a66bc80 100644
--- a/addons/website/static/src/js/website.editor.js
+++ b/addons/website/static/src/js/website.editor.js
@@ -3,6 +3,7 @@
 
     var website = openerp.website;
     var _t = openerp._t;
+    website.no_editor = !!$(document.documentElement).data('editable-no-editor');
 
     website.add_template_file('/website/static/src/xml/website.editor.xml');
     website.dom_ready.done(function () {
@@ -496,6 +497,17 @@
             this.$('#website-top-edit').hide();
             this.$('#website-top-view').show();
 
+            if (website.no_editor) {
+                var help_text = $(document.documentElement).data('editable-no-editor');
+                this.$('button[data-action=edit]')
+                    .prop('disabled', website.no_editor)
+                    .parent()
+                    // help must be set on form above button because it does
+                    // not appear on disabled button
+                    .attr('title', help_text);
+            }
+
+
             $('.dropdown-toggle').dropdown();
             this.customize_setup();