[FIX] website_slides: Remove read access on slide.answer

This commit removes the read access on slide.answer for all
users except website_publisher and admin

Task: #1947884
PR: #32083

Signed-off-by: Thibault Delavallee (tde) <tde@openerp.com>

4 files changed, 39 insertions, 33 deletions

diff --git a/addons/website_slides/controllers/main.py b/addons/website_slides/controllers/main.py
index edb00cc0e7b..b18987a2f10 100644
--- a/addons/website_slides/controllers/main.py
+++ b/addons/website_slides/controllers/main.py
@@ -119,9 +119,25 @@ class WebsiteSlides(WebsiteProfile):
 
         return values
 
-    def _get_slide_quiz_info(self, slide, quiz_done=False):
+    def _get_slide_quiz_partner_info(self, slide, quiz_done=False):
         return slide._compute_quiz_info(request.env.user.partner_id, quiz_done=quiz_done)[slide.id]
 
+    def _get_slide_quiz_data(self, slide):
+        slide_completed = slide.user_membership_id.sudo().completed
+        values = {
+            'slide_questions': [{
+                'id': question.id,
+                'question': question.question,
+                'answers': [{
+                    'id': answer.id,
+                    'text_value': answer.text_value,
+                    'is_correct': answer.is_correct if slide_completed else None
+                } for answer in question.sudo().answer_ids],
+            } for question in slide.question_ids]
+        }
+        values.update(self._get_slide_quiz_partner_info(slide))
+        return values
+
     # CHANNEL UTILITIES
     # --------------------------------------------------
 
@@ -489,7 +505,7 @@ class WebsiteSlides(WebsiteProfile):
         values = self._get_slide_detail(slide)
         # quiz-specific: update with karma and quiz information
         if slide.question_ids:
-            values.update(self._get_slide_quiz_info(slide))
+            values.update(self._get_slide_quiz_data(slide))
         # sidebar: update with user channel progress
         values['channel_progress'] = self._get_channel_progress(slide.channel_id, include_quiz=True)
 
@@ -623,22 +639,7 @@ class WebsiteSlides(WebsiteProfile):
         if fetch_res.get('error'):
             return fetch_res
         slide = fetch_res['slide']
-        quiz_info = self._get_slide_quiz_info(slide)
-        slide_completed = slide.user_membership_id.sudo().completed
-        return {
-            'questions': [{
-                'id': question.id,
-                'question': question.question,
-                'answers': [{
-                    'id': answer.id,
-                    'text_value': answer.text_value,
-                    'is_correct': answer.is_correct if slide_completed else None
-                } for answer in question.answer_ids],
-            } for question in slide.question_ids],
-            'quizAttemptsCount': quiz_info['quiz_attempts_count'],
-            'quizKarmaGain': quiz_info['quiz_karma_gain'],
-            'quizKarmaWon': quiz_info['quiz_karma_won'],
-        }
+        return self._get_slide_quiz_data(slide)
 
     @http.route('/slides/slide/quiz/submit', type="json", auth="public", website=True)
     def slide_quiz_submit(self, slide_id, answer_ids):
@@ -662,7 +663,7 @@ class WebsiteSlides(WebsiteProfile):
         user_good_answers = user_answers - user_bad_answers
 
         self._set_viewed_slide(slide, quiz_attempts_inc=True)
-        quiz_info = self._get_slide_quiz_info(slide, quiz_done=True)
+        quiz_info = self._get_slide_quiz_partner_info(slide, quiz_done=True)
 
         rank_progress = {}
         if not user_bad_answers:
diff --git a/addons/website_slides/security/ir.model.access.csv b/addons/website_slides/security/ir.model.access.csv
index ce9bcf2593d..82fbf8312ea 100644
--- a/addons/website_slides/security/ir.model.access.csv
+++ b/addons/website_slides/security/ir.model.access.csv
@@ -5,7 +5,7 @@ access_slide_slide_partner_all,slide.slide.partner.all,model_slide_slide_partner
 access_slide_slide_partner_system,slide.slide.partner.system,model_slide_slide_partner,website.group_website_publisher,1,1,1,1
 access_slide_question_all,slide.question.all,model_slide_question,,1,0,0,0
 access_slide_question_publisher,slide.question.publisher,model_slide_question,website.group_website_publisher,1,1,1,1
-access_slide_answer_all,slide.answer.all,model_slide_answer,,1,0,0,0
+access_slide_answer_all,slide.answer.all,model_slide_answer,,0,0,0,0
 access_slide_answer_publisher,slide.answer.publisher,model_slide_answer,website.group_website_publisher,1,1,1,1
 access_slide_tag_all,slide.tag.all,model_slide_tag,,1,0,0,0
 access_slide_tag_publisher,slide.tag.publisher,model_slide_tag,website.group_website_publisher,1,1,1,1
diff --git a/addons/website_slides/static/src/js/slides_course_quiz.js b/addons/website_slides/static/src/js/slides_course_quiz.js
index d1033c75f81..23a54357880 100644
--- a/addons/website_slides/static/src/js/slides_course_quiz.js
+++ b/addons/website_slides/static/src/js/slides_course_quiz.js
@@ -106,7 +106,12 @@ odoo.define('website_slides.quiz', function (require) {
                     'slide_id': self.slide.id,
                 }
             }).then(function (quiz_data) {
-                self.quiz = quiz_data;
+                self.quiz = {
+                    questions: quiz_data.slide_questions,
+                    quizAttemptsCount: quiz_data.quiz_attempts_count,
+                    quizKarmaGain: quiz_data.quiz_karma_gain,
+                    quizKarmaWon: quiz_data.quiz_karma_won
+                };
             });
         },
 
diff --git a/addons/website_slides/views/website_slides_templates_lesson.xml b/addons/website_slides/views/website_slides_templates_lesson.xml
index 5978d63e8b5..6676cc4932f 100644
--- a/addons/website_slides/views/website_slides_templates_lesson.xml
+++ b/addons/website_slides/views/website_slides_templates_lesson.xml
@@ -426,27 +426,27 @@
         t-att-data-quiz-karma-won="quiz_karma_won"
         t-att-data-has-next="1 if next_slide else 0"
         t-att-data-next-slide-url="'/slides/slide/%s' % (slug(next_slide)) if next_slide else None">
-        <div t-foreach="slide.question_ids" t-as="question"
-            t-att-class="'o_wslides_js_lesson_quiz_question mt-3 %s' % ('completed-disabled' if slide_completed else ('disabled' if not slide.channel_id.is_member else ''))" t-att-data-question-id="question.id" t-att-data-title="question.question">
+        <div t-foreach="slide_questions" t-as="question"
+            t-att-class="'o_wslides_js_lesson_quiz_question mt-3 %s' % ('completed-disabled' if slide_completed else ('disabled' if not slide.channel_id.is_member else ''))" t-att-data-question-id="question['id']" t-att-data-title="question['question']">
             <div class="h4">
-                <small class="text-muted"><span t-esc="question_index+1"/>. </small> <span t-esc="question.question"/>
+                <small class="text-muted"><span t-esc="question_index+1"/>. </small> <span t-esc="question['question']"/>
             </div>
             <div class="list-group">
-                <t t-foreach="question.answer_ids" t-as="answer">
-                    <a t-att-data-answer-id="answer.id" href="#"
-                        t-att-data-text="answer.text_value"
-                        t-att-class="'o_wslides_quiz_answer list-group-item list-group-item-action d-flex align-items-center %s' % ('list-group-item-success' if slide_completed and answer.is_correct else '')">
+                <t t-foreach="question['answers']" t-as="answer">
+                    <a t-att-data-answer-id="answer['id']" href="#"
+                        t-att-data-text="answer['text_value']"
+                        t-att-class="'o_wslides_quiz_answer list-group-item list-group-item-action d-flex align-items-center %s' % ('list-group-item-success' if slide_completed and answer['is_correct'] else '')">
                         <label class="my-0 d-flex align-items-center justify-content-center mr-2">
                             <input type="radio"
-                                t-att-name="question.id"
-                                t-att-value="answer.id"
+                                t-att-name="question['id']"
+                                t-att-value="answer['id']"
                                 class="d-none"
                                 t-att-disabled="True if not slide.channel_id.is_member or slide_completed else ''"/>
-                            <i t-att-class="'fa fa-circle text-400 %s' % ('d-none' if slide_completed and answer.is_correct else '')"/>
+                            <i t-att-class="'fa fa-circle text-400 %s' % ('d-none' if slide_completed and answer['is_correct'] else '')"/>
                             <i class="fa fa-times-circle text-danger d-none"></i>
-                            <i t-att-class="'fa fa-check-circle text-success %s' % ('d-none' if not (slide_completed and answer.is_correct) else '')"></i>
+                            <i t-att-class="'fa fa-check-circle text-success %s' % ('d-none' if not (slide_completed and answer['is_correct']) else '')"></i>
                         </label>
-                        <span t-esc="answer.text_value"/>
+                        <span t-esc="answer['text_value']"/>
                     </a>
                 </t>
             </div>