From 7d1f7ee10a6a71df6e031547a31dc24bd4494e24 Mon Sep 17 00:00:00 2001
From: Xavier Morel <xmo@openerp.com>
Date: Tue, 4 Feb 2014 17:58:23 +0100
Subject: [IMP] handling of overly large images in website image upload

bzr revid: xmo@openerp.com-20140204165823-q05aoq83q28b2hhg
---
 addons/website/controllers/main.py | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

(limited to 'addons/website/controllers/main.py')

diff --git a/addons/website/controllers/main.py b/addons/website/controllers/main.py
index b9fc68bb667..0a3f717740f 100644
--- a/addons/website/controllers/main.py
+++ b/addons/website/controllers/main.py
@@ -239,13 +239,20 @@ class Website(openerp.addons.web.controllers.main.Home):
 
     @http.route('/website/attach', type='http', auth='user', methods=['POST'], website=True)
     def attach(self, func, upload):
-        req = request.httprequest
 
         url = message = None
         try:
+            image_data = upload.read()
+            image = Image.open(cStringIO.StringIO(image_data))
+            w, h = image.size
+            if w*h > 42e6: # Nokia Lumia 1020 photo resolution
+                raise ValueError(
+                    u"Image size excessive, uploaded images must be smaller "
+                    u"than 42 million pixel")
+
             attachment_id = request.registry['ir.attachment'].create(request.cr, request.uid, {
                 'name': upload.filename,
-                'datas': upload.read().encode('base64'),
+                'datas': image_data.encode('base64'),
                 'datas_fname': upload.filename,
                 'res_model': 'ir.ui.view',
             }, request.context)
@@ -259,7 +266,7 @@ class Website(openerp.addons.web.controllers.main.Home):
             })
         except Exception, e:
             logger.exception("Failed to upload image to attachment")
-            message = str(e)
+            message = unicode(e)
 
         return """<script type='text/javascript'>
             window.parent['%s'](%s, %s);
-- 
cgit v1.2.3


From 8df6b16784b64d4ebb375290f96a7c8e2fd4f949 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Thibault=20Delavall=C3=A9e?= <tde@openerp.com>
Date: Wed, 5 Feb 2014 10:04:47 +0100
Subject: [ADD] website: added support for invoking a server action through
 controller

website: added website/action/<id_or_xml_id> route, that runs the server action designed
by its id or xml_id. Only code server action returning a template give a result. The
template is displayed. Other or not existing server actions redirect to the homepage.

website: added an override of ir_actions_server: evaluation context gets request for
evaluation, to enable request.render(template_name); also returns template the same
way action is returned for code server action;

bzr revid: tde@openerp.com-20140205090447-2hppg7818nx1wfzh
---
 addons/website/controllers/main.py | 33 ++++++++++++++++++++++++++++++---
 1 file changed, 30 insertions(+), 3 deletions(-)

(limited to 'addons/website/controllers/main.py')

diff --git a/addons/website/controllers/main.py b/addons/website/controllers/main.py
index b9fc68bb667..9cd22a76e6e 100644
--- a/addons/website/controllers/main.py
+++ b/addons/website/controllers/main.py
@@ -9,7 +9,6 @@ import datetime
 
 from sys import maxint
 
-import psycopg2
 import werkzeug
 import werkzeug.exceptions
 import werkzeug.utils
@@ -27,6 +26,7 @@ logger = logging.getLogger(__name__)
 # Completely arbitrary limits
 MAX_IMAGE_WIDTH, MAX_IMAGE_HEIGHT = IMAGE_LIMITS = (1024, 768)
 
+
 class Website(openerp.addons.web.controllers.main.Home):
     #------------------------------------------------------
     # View
@@ -366,5 +366,32 @@ class Website(openerp.addons.web.controllers.main.Home):
 
         return response
 
-
-# vim:expandtab:tabstop=4:softtabstop=4:shiftwidth=4:
+    #------------------------------------------------------
+    # Server actions
+    #------------------------------------------------------
+    @http.route(['/website/action/<id_or_xml_id>'], type='http', auth="public", website=True)
+    def actions_server(self, id_or_xml_id, **post):
+        cr, uid, context = request.cr, request.uid, request.context
+        res, action_id, action = None, None, None
+        ServerActions = request.registry['ir.actions.server']
+
+        # find the action_id, either an int, an int into a basestring, or an xml_id
+        if isinstance(id_or_xml_id, basestring) and '.' in id_or_xml_id:
+            action_id = request.registry['ir.model.data'].xmlid_to_res_id(request.cr, request.uid, id_or_xml_id, raise_if_not_found=False)
+        else:
+            try:
+                action_id = int(id_or_xml_id)
+            except ValueError:
+                pass
+        # check it effectively exists
+        if action_id:
+            action_ids = ServerActions.exists(cr, uid, [action_id], context=context)
+            action_id = action_ids and action_ids[0] or None
+        # run it, return only LazyResponse that are templates to be rendered
+        if action_id:
+            action_res = ServerActions.run(cr, uid, [action_id], context=context)
+            if isinstance(action_res, LazyResponse):
+                res = action_res
+        if res:
+            return res
+        return request.redirect('/')
-- 
cgit v1.2.3


From 1e6f81abc2ae0d1c19fbdad333bc1df2208daea9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Thibault=20Delavall=C3=A9e?= <tde@openerp.com>
Date: Wed, 5 Feb 2014 10:45:30 +0100
Subject: [IMP] website: ir_actions_server: only published server action can be
 invoked from the front-end

bzr revid: tde@openerp.com-20140205094530-k058ealuxq9hbrdw
---
 addons/website/controllers/main.py | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

(limited to 'addons/website/controllers/main.py')

diff --git a/addons/website/controllers/main.py b/addons/website/controllers/main.py
index 9cd22a76e6e..29d2652ba94 100644
--- a/addons/website/controllers/main.py
+++ b/addons/website/controllers/main.py
@@ -374,6 +374,10 @@ class Website(openerp.addons.web.controllers.main.Home):
         cr, uid, context = request.cr, request.uid, request.context
         res, action_id, action = None, None, None
         ServerActions = request.registry['ir.actions.server']
+        # add the post values in the context, to be able to handle it
+        if context is None:
+            context = {}
+        context.get('post', {}).update(post)
 
         # find the action_id, either an int, an int into a basestring, or an xml_id
         if isinstance(id_or_xml_id, basestring) and '.' in id_or_xml_id:
@@ -389,9 +393,11 @@ class Website(openerp.addons.web.controllers.main.Home):
             action_id = action_ids and action_ids[0] or None
         # run it, return only LazyResponse that are templates to be rendered
         if action_id:
-            action_res = ServerActions.run(cr, uid, [action_id], context=context)
-            if isinstance(action_res, LazyResponse):
-                res = action_res
+            action = ServerActions.browse(cr, uid, action_id, context=context)
+            if action.state == 'code' and action.website_published:
+                action_res = ServerActions.run(cr, uid, [action_id], context=context)
+                if isinstance(action_res, LazyResponse):
+                    res = action_res
         if res:
             return res
         return request.redirect('/')
-- 
cgit v1.2.3


From 1c608569ca96fad950781cb330a122e7a3b83ec1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Thibault=20Delavall=C3=A9e?= <tde@openerp.com>
Date: Wed, 5 Feb 2014 11:55:55 +0100
Subject: [IMP] website: server action in front-end: updated demo data to show
 something vaguely complex that 'everyone' can do using 2 server actions and 2
 templates: a basic partner directory.

bzr revid: tde@openerp.com-20140205105555-hzpwwqgefdiy12jg
---
 addons/website/controllers/main.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'addons/website/controllers/main.py')

diff --git a/addons/website/controllers/main.py b/addons/website/controllers/main.py
index 29d2652ba94..c043ff82458 100644
--- a/addons/website/controllers/main.py
+++ b/addons/website/controllers/main.py
@@ -377,7 +377,7 @@ class Website(openerp.addons.web.controllers.main.Home):
         # add the post values in the context, to be able to handle it
         if context is None:
             context = {}
-        context.get('post', {}).update(post)
+        context['post'] = post or {}
 
         # find the action_id, either an int, an int into a basestring, or an xml_id
         if isinstance(id_or_xml_id, basestring) and '.' in id_or_xml_id:
-- 
cgit v1.2.3


From 79d6a1a39aa1f5a45ae7371f00068023bfd8952d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Thibault=20Delavall=C3=A9e?= <tde@openerp.com>
Date: Wed, 5 Feb 2014 15:02:16 +0100
Subject: [IMP] website: server action controller: no need to add post,
 everything is on request

bzr revid: tde@openerp.com-20140205140216-r6oxlbbmypd3u5vf
---
 addons/website/controllers/main.py | 4 ----
 1 file changed, 4 deletions(-)

(limited to 'addons/website/controllers/main.py')

diff --git a/addons/website/controllers/main.py b/addons/website/controllers/main.py
index c043ff82458..e97a3be9d97 100644
--- a/addons/website/controllers/main.py
+++ b/addons/website/controllers/main.py
@@ -374,10 +374,6 @@ class Website(openerp.addons.web.controllers.main.Home):
         cr, uid, context = request.cr, request.uid, request.context
         res, action_id, action = None, None, None
         ServerActions = request.registry['ir.actions.server']
-        # add the post values in the context, to be able to handle it
-        if context is None:
-            context = {}
-        context['post'] = post or {}
 
         # find the action_id, either an int, an int into a basestring, or an xml_id
         if isinstance(id_or_xml_id, basestring) and '.' in id_or_xml_id:
-- 
cgit v1.2.3


From d819d494f11d275cdd9ad2a7078ae93d4ef59dc1 Mon Sep 17 00:00:00 2001
From: Christophe Matthieu <chm@openerp.com>
Date: Thu, 6 Feb 2014 14:50:36 +0100
Subject: [IMP] website: add debugger template used to create nex tours/tests
 (display in customize menu in debug mode)

bzr revid: chm@openerp.com-20140206135036-geq8fubtz39pxp20
---
 addons/website/controllers/main.py | 2 ++
 1 file changed, 2 insertions(+)

(limited to 'addons/website/controllers/main.py')

diff --git a/addons/website/controllers/main.py b/addons/website/controllers/main.py
index 0a3f717740f..a6d8f2982f9 100644
--- a/addons/website/controllers/main.py
+++ b/addons/website/controllers/main.py
@@ -179,6 +179,7 @@ class Website(openerp.addons.web.controllers.main.Home):
                     result.append({
                         'name': v.inherit_option_id.name,
                         'id': v.id,
+                        'xml_id': v.xml_id,
                         'inherit_id': v.inherit_id.id,
                         'header': True,
                         'active': False
@@ -187,6 +188,7 @@ class Website(openerp.addons.web.controllers.main.Home):
                 result.append({
                     'name': v.name,
                     'id': v.id,
+                    'xml_id': v.xml_id,
                     'inherit_id': v.inherit_id.id,
                     'header': False,
                     'active': (v.inherit_id.id == v.inherit_option_id.id) or (not optional and v.inherit_id.id)
-- 
cgit v1.2.3