From fb289e0b5d7efdf3c74fa9080da7b6f29dc3ff8e Mon Sep 17 00:00:00 2001 From: Fabien Pinckaers Date: Sat, 2 Jul 2016 06:23:25 +0200 Subject: [SEC] rating: escape feedback, text2html to avoid js injection [IMP] rating: website rating page: reviewed design, rate on click, update on submit [IMP] rating_project: rating_status: 'no' instead of False [IMP] rating_project/issue: smileys insteaf of thumbs for consistency in kanban [IMP] rating: allow to update an existing rating (feedback + rate) [IMP] rating: consistency on rating names (statisfied, not satisfied, higly dissatisfed) [IMP] rating: avoid deadend after rating, button to go to Odoo [IMP] rating: res_config better sentence --- addons/website_rating_project_issue/controllers/main.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'addons/website_rating_project_issue/controllers/main.py') diff --git a/addons/website_rating_project_issue/controllers/main.py b/addons/website_rating_project_issue/controllers/main.py index ceae1822438..c46e32a6b0a 100644 --- a/addons/website_rating_project_issue/controllers/main.py +++ b/addons/website_rating_project_issue/controllers/main.py @@ -10,7 +10,7 @@ class WebsiteRatingProject(http.Controller): @http.route(['/project/rating/'], type='http', auth="public", website=True) def index(self, **kw): - projects = request.env['project.project'].sudo().search([('rating_status', '!=', False), ('website_published', '=', True)]) + projects = request.env['project.project'].sudo().search([('rating_status', '!=', 'no'), ('website_published', '=', True)]) values = {'projects': projects} return request.website.render('website_rating_project_issue.index', values) @@ -20,7 +20,7 @@ class WebsiteRatingProject(http.Controller): project = request.env['project.project'].sudo().browse(project_id) # to avoid giving any access rights on projects to the public user, let's use sudo # and check if the user should be able to view the project (project managers only if it's unpublished or has no rating) - if not (project.rating_status and project.website_published) and not user.sudo(user).has_group('project.group_project_manager'): + if not ((project.rating_status<>'no') and project.website_published) and not user.sudo(user).has_group('project.group_project_manager'): raise NotFound() values = { 'project': project, -- cgit v1.2.3