From 75638ffb94fa4ae1753f733d8cb6f7f58f0b6a0a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thibault=20Delavall=C3=A9e?= Date: Fri, 19 Oct 2018 10:46:26 +0000 Subject: [REF] link_tracker: do not let public read technical / private link data Link tracker models are rather technical and should not be accessed as it is by external people. Let us delegate control to controllers and lessen a bit model accessibility. Currently everyone can use add_click method and generate statistics. Now statistics will be generated only through dedicated routes. It will make statistics more reliable and ensure technical data remain private. Next commit will update code from controllers and main methods in order to be have a more readable click API and avoid link between non dependent modules. This commit is linked to task ID 1904277 and PR #28242. --- addons/link_tracker/controller/main.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'addons/link_tracker/controller') diff --git a/addons/link_tracker/controller/main.py b/addons/link_tracker/controller/main.py index c03cbf56813..3b23c005446 100644 --- a/addons/link_tracker/controller/main.py +++ b/addons/link_tracker/controller/main.py @@ -11,6 +11,6 @@ class LinkTracker(http.Controller): @http.route('/r/', type='http', auth='none', website=True) def full_url_redirect(self, code, **post): country_code = request.session.geoip and request.session.geoip.get('country_code') or False - request.env['link.tracker.click'].add_click(code, request.httprequest.remote_addr, country_code, stat_id=False) + request.env['link.tracker.click'].sudo().add_click(code, request.httprequest.remote_addr, country_code, stat_id=False) redirect_url = request.env['link.tracker'].get_url_from_code(code) return werkzeug.utils.redirect(redirect_url or '', 301) -- cgit v1.2.3