diff options
| author | Fabien Pinckaers <fp@openerp.com> | 2016-07-02 06:23:25 +0200 |
|---|---|---|
| committer | Fabien Pinckaers <fp@openerp.com> | 2016-07-02 18:33:55 +0200 |
| commit | fb289e0b5d7efdf3c74fa9080da7b6f29dc3ff8e (patch) | |
| tree | 4dbfac2f9faa7817e398c30f24c4f768e80d4c90 /addons/website_rating_project_issue/controllers | |
| parent | 580129522f4c0e53dbdaee38c51537413dfa3020 (diff) | |
[SEC] rating: escape feedback, text2html to avoid js injection
[IMP] rating: website rating page: reviewed design, rate on click, update on submit
[IMP] rating_project: rating_status: 'no' instead of False
[IMP] rating_project/issue: smileys insteaf of thumbs for consistency in kanban
[IMP] rating: allow to update an existing rating (feedback + rate)
[IMP] rating: consistency on rating names (statisfied, not satisfied, higly dissatisfed)
[IMP] rating: avoid deadend after rating, button to go to Odoo
[IMP] rating: res_config better sentence
Diffstat (limited to 'addons/website_rating_project_issue/controllers')
| -rw-r--r-- | addons/website_rating_project_issue/controllers/main.py | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/addons/website_rating_project_issue/controllers/main.py b/addons/website_rating_project_issue/controllers/main.py index ceae1822438..c46e32a6b0a 100644 --- a/addons/website_rating_project_issue/controllers/main.py +++ b/addons/website_rating_project_issue/controllers/main.py @@ -10,7 +10,7 @@ class WebsiteRatingProject(http.Controller): @http.route(['/project/rating/'], type='http', auth="public", website=True) def index(self, **kw): - projects = request.env['project.project'].sudo().search([('rating_status', '!=', False), ('website_published', '=', True)]) + projects = request.env['project.project'].sudo().search([('rating_status', '!=', 'no'), ('website_published', '=', True)]) values = {'projects': projects} return request.website.render('website_rating_project_issue.index', values) @@ -20,7 +20,7 @@ class WebsiteRatingProject(http.Controller): project = request.env['project.project'].sudo().browse(project_id) # to avoid giving any access rights on projects to the public user, let's use sudo # and check if the user should be able to view the project (project managers only if it's unpublished or has no rating) - if not (project.rating_status and project.website_published) and not user.sudo(user).has_group('project.group_project_manager'): + if not ((project.rating_status<>'no') and project.website_published) and not user.sudo(user).has_group('project.group_project_manager'): raise NotFound() values = { 'project': project, |