[FIX] website: make handle_visibility private

This commit:
   - make handle_visibility a private function (even if not
     exploitable in rpc easily since it uses request.website)
   - encrypt the password in db (even if not critic, since this
     password could be shared on twitter, ... it doesn't cost anything
     to secure it a bit more)
   - remove useless sudo, since handle_visibility does a sudo itself.

In the future, this notion of visibility should be handled on controller layer,
and no more on the View layer (during rendering)

closes odoo/odoo#48145

X-original-commit: 06e0e48217f25f17dff23331111f5dcb98e8cecd
Signed-off-by: Martin Trigaux (mat) <mat@odoo.com>
Signed-off-by: Christophe Monniez (moc) <moc@odoo.com>

2 files changed, 29 insertions, 2 deletions

diff --git a/addons/website/static/src/js/menu/content.js b/addons/website/static/src/js/menu/content.js
index d8be9ba80ff..8f949441224 100644
--- a/addons/website/static/src/js/menu/content.js
+++ b/addons/website/static/src/js/menu/content.js
@@ -22,6 +22,8 @@ var PagePropertiesDialog = weWidgets.Dialog.extend({
         'keyup input#page_name': '_onNameChanged',
         'keyup input#page_url': '_onUrlChanged',
         'change input#create_redirect': '_onCreateRedirectChanged',
+        'click input#visibility_password': '_onPasswordClicked',
+        'change input#visibility_password': '_onPasswordChanged',
         'change select#visibility': '_onVisibilityChanged',
     }),
 
@@ -234,10 +236,19 @@ var PagePropertiesDialog = weWidgets.Dialog.extend({
             redirect_type: this.$('#redirect_type').val(),
             website_indexed: this.$('#is_indexed').prop('checked'),
             visibility: this.$('#visibility').val(),
-            visibility_password: this.$('#visibility').val() === 'password' ? this.$('#visibility_password').val() : false,
             visibility_group: this.$('#visibility').val() === 'restricted_group' ? this.$('#visibility_group').data('group-id') : false,
             date_publish: datePublish,
         };
+        if (this.$('#visibility').val() === 'password') {
+            var field_pwd = $('#visibility_password');
+            if (!field_pwd.get(0).reportValidity()) {
+                return;
+            }
+            if (field_pwd.data('dirty')) {
+                params['visibility_pwd'] = field_pwd.val();
+            }
+        }
+
         this._rpc({
             model: 'website.page',
             method: 'save_page_info',
@@ -408,6 +419,19 @@ var PagePropertiesDialog = weWidgets.Dialog.extend({
     _onVisibilityChanged: function (ev) {
         this.$('.show_visibility_password').toggleClass('d-none', ev.target.value !== 'password');
         this.$('.show_visibility_group').toggleClass('d-none', ev.target.value !== 'restricted_group');
+        this.$('#visibility_password').attr('required', ev.target.value === 'password');
+    },
+    /**
+     * @private
+     */
+    _onPasswordClicked: function (ev) {
+        ev.target.value = '';
+        this._onPasswordChanged();
+    },    /**
+     * @private
+     */
+    _onPasswordChanged: function () {
+        this.$('#visibility_password').data('dirty', 1);
     },
 });
 
diff --git a/addons/website/static/src/xml/website.pageProperties.xml b/addons/website/static/src/xml/website.pageProperties.xml
index 54b204fa103..e38a9555826 100644
--- a/addons/website/static/src/xml/website.pageProperties.xml
+++ b/addons/website/static/src/xml/website.pageProperties.xml
@@ -152,7 +152,10 @@
                             <div class="ml-1 input-group-prepend show_visibility_password" >
                                 <div class="input-group-text"><i class="fa fa-key"></i></div>
                             </div>
-                            <input type="text" t-att-value='widget.page.visibility_password ? widget.page.visibility_password : ""' class="form-control show_visibility_password" id="visibility_password"/>
+                            <input type="password" id="visibility_password"
+                                   t-att-value='widget.page.visibility_password'
+                                   t-att-required="widget.page.visibility == 'password' ? 'required' : None"
+                                   class="form-control show_visibility_password"/>
                             <div class="ml-1 input-group-prepend show_visibility_group">
                                 <div class="input-group-text"><i class="fa fa-group"></i></div>
                             </div>