[FIX] website_mail: fixed is_follower controller, that could leak data about records.

Added instead a controller to get alias data. This controller is called by the
discussion group snippet to have the info about the alias.

1 files changed, 20 insertions, 10 deletions

diff --git a/addons/website_mail/static/src/js/website_mail.js b/addons/website_mail/static/src/js/website_mail.js
index d069f88ea45..2a79bccccc5 100644
--- a/addons/website_mail/static/src/js/website_mail.js
+++ b/addons/website_mail/static/src/js/website_mail.js
@@ -12,15 +12,12 @@
             openerp.jsonRpc('/website_mail/is_follower', 'call', {
                 model: this.$target.data('object'),
                 id: this.$target.data('id'),
-                fields: ['name', 'alias_id'],
+                get_alias_info: true,
             }).always(function (data) {
                 self.is_user = data.is_user;
-                self.$target.find('.js_mg_email').attr('href', 'mailto:' + data.alias_id[1]);
-                self.$target.find('.js_mg_link').attr('href', '/groups/' + data.id);
-                self.toggle_subscription(data.is_follower);
-                self.$target.find('input.js_follow_email')
-                    .val(data.email ? data.email : "")
-                    .attr("disabled", data.is_follower || (data.email.length && self.is_user) ? "disabled" : false);
+                self.email = data.email;
+                self.$target.find('.js_mg_link').attr('href', '/groups/' + self.$target.data('id'));
+                self.toggle_subscription(data.is_follower, data.email);
                 self.$target.removeClass("hidden");
             });
 
@@ -51,10 +48,11 @@
                 'message_is_follower': this.$target.attr("data-follow") || "off",
                 'email': $email.length ? $email.val() : false,
             }).then(function (follow) {
-                self.toggle_subscription(follow);
+                self.toggle_subscription(follow, self.email);
             });
         },
-        toggle_subscription: function(follow) {
+        toggle_subscription: function(follow, email) {
+            var alias_done = this.get_alias_info();
             if (follow) {
                 this.$target.find(".js_mg_follow_form").addClass("hidden");
                 this.$target.find(".js_mg_details").removeClass("hidden");
@@ -63,9 +61,21 @@
                 this.$target.find(".js_mg_follow_form").removeClass("hidden");
                 this.$target.find(".js_mg_details").addClass("hidden");
             }
-            this.$target.find('input.js_follow_email').attr("disabled", follow || this.is_user ? "disabled" : false);
+            this.$target.find('input.js_follow_email')
+                .val(email ? email : "")
+                .attr("disabled", follow || (email.length && this.is_user) ? "disabled" : false);
             this.$target.attr("data-follow", follow ? 'on' : 'off');
+            return $.when(alias_done);
         },
+        get_alias_info: function() {
+            var self = this;
+            return openerp.jsonRpc('/website_mail/get_alias_info', 'call', {
+                model: this.$target.data('object'),
+                id: this.$target.data('id'),
+            }).then(function (data) {
+                self.$target.find('.js_mg_email').attr('href', 'mailto:' + data.alias_name);
+            });
+        }
     });
 
     $(document).ready(function () {