[IMP] website_mail: generic chatter implementation

A new generic chatter template is available in website_mail
This template allows access rights escalation when some kind of token or uuid
is available on the model or if you use the object_shasign function in the
main controller of website_maill to generate a cryptographic signature to allow
commenting on any object.

To use this chatter, you need to make a t-call to website_maill.thread in your
template after having set the following variables:
- chatter_object: the browserecord of the mail_thread object (mandatory)
- token: if you use a token system  (optional)
- token_field: name of the field that stores the token on your object  (optional)
- sha_in: if you use a shasign to allow public comment  (optional)
- nosubscribe: set False if you want the partner to be set as follower of the object  (optional)
- message_type, subtype: see message_post in mail_thread.py

1 files changed, 84 insertions, 0 deletions

diff --git a/addons/website_mail/controllers/main.py b/addons/website_mail/controllers/main.py
index d87bdec7ca1..7a12f471c23 100644
--- a/addons/website_mail/controllers/main.py
+++ b/addons/website_mail/controllers/main.py
@@ -1,11 +1,74 @@
 # -*- coding: utf-8 -*-
 # Part of Odoo. See LICENSE file for full copyright and licensing details.
+from hashlib import sha1
+from time import time
+from werkzeug.exceptions import NotFound
 
 from openerp import SUPERUSER_ID
 from openerp.addons.web import http
 from openerp.addons.web.http import request
 
 
+def object_shasign(record=False, res_model='', res_id=None, **kw):
+    """ Generate a sha signature using the current time, database secret and the
+    record object or the res_model and res_id parameters
+        Return the sha signature and the time of generation in a tuple"""
+    secret = request.env['ir.config_parameter'].sudo().get_param('database.secret')
+    shasign = False
+    timestamp = int(time())
+    if record:
+        shasign = sha1('%s%s%s%s' % (record._model, record.id, secret, timestamp)).hexdigest()
+    elif res_model and res_id:
+        shasign = sha1('%s%s%s%s' % (res_model, res_id, secret, timestamp)).hexdigest()
+    return (shasign, timestamp)
+
+
+def _message_post_helper(res_model='', res_id=None, message='', token='', token_field='token', sha_in='', sha_time=None, nosubscribe=True, **kw):
+    """ Generic chatter function, allowing to write on *any* object that inherits mail.thread.
+        If a token or a shasign is specified, all logged in users will be able to write a message regardless
+        of access rights; if the user is the public user, the message will be posted under the name
+        of the partner_id of the object (or the public user if there is no partner_id on the object).
+
+        :param string res_model: model name of the object
+        :param int res_id: id of the object
+        :param string message: content of the message
+
+        optional keywords arguments:
+        :param string token: access token if the object's model uses some kind of public access
+                             using tokens (usually a uuid4) to bypass access rules
+        :param string token_field: name of the field that contains the token on the object (defaults to 'token')
+        :param string sha_in: sha1 hash of the string composed of res_model, res_id and the dabase secret in ir.config_parameter
+                               if you wish to allow public users to write on the object with some security but you don't want
+                               to add a token field on the object, the sha-sign prevents public users from writing to any other
+                               object that the one specified by res_model and res_id
+                               to generate the shasign, you can import the function object_shasign from this file in your controller
+        :param str sha_time: timestamp of sha signature generation (signatures are valid for 24h)
+        :param bool nosubscribe: set False if you want the partner to be set as follower of the object when posting (default to True)
+
+        The rest of the kwargs are passed on to message_post()
+    """
+    res = request.env[res_model].browse(res_id)
+    author_id = request.env.user.partner_id.id
+    if token and res and token == getattr(res.sudo(), token_field, None):
+        res = res.sudo()
+        if request.env.user == request.env['ir.model.data'].xmlid_to_object('base.public_user'):
+            author_id = (res.partner_id and res.partner_id.id) if hasattr(res, 'partner_id') else author_id
+        else:
+            raise NotFound()
+    elif sha_in:
+        timestamp = int(sha_time)
+        secret = request.env['ir.config_parameter'].sudo().get_param('database.secret')
+        shasign = sha1('%s%s%s%s' % (res_model, res_id, secret, timestamp))
+        if sha_in == shasign.hexdigest() and int(time()) < timestamp + 3600 * 24:
+            res = res.sudo()
+        else:
+            raise NotFound()
+    return res.with_context({'mail_create_nosubscribe': nosubscribe}).message_post(body=message,
+                                                                                   message_type=kw.pop('message_type', False) or "comment",
+                                                                                   subtype=kw.pop('subtype', False) or "mt_comment",
+                                                                                   author_id=author_id,
+                                                                                   **kw)
+
 class WebsiteMail(http.Controller):
 
     @http.route(['/website_mail/follow'], type='json', auth="public", website=True)
@@ -79,3 +142,24 @@ class WebsiteMail(http.Controller):
                             ('partner_id', '=', partner_id.id)
                         ], context=context)) == 1
         return values
+
+    @http.route(['/website_mail/post/json'], type='json', auth='public', website=True)
+    def chatter_json(self, res_model='', res_id=None, message='', **kw):
+        res_id = int(res_id)
+        try:
+            msg = _message_post_helper(res_model, res_id, message, **kw)
+            data = {
+                'body': msg.body,
+                'date': msg.date,
+                'author': msg.author_id.name,
+                'image_url': request.website.image_url(msg.author_id, 'image_small')
+            }
+            return data
+        except Exception:
+            return False
+
+    @http.route(['/website_mail/post/post'], type='http', method=['POST'], auth='public', website=True)
+    def chatter_post(self, res_model='', res_id=None, message='', redirect=None, **kw):
+        res_id = int(res_id)
+        _message_post_helper(res_model, res_id, message, **kw)
+        return request.redirect(request.httprequest.referrer)