[IMP] prevent edition of page if groups which current user doesn't have
authorXavier Morel <xmo@openerp.com>
Tue, 17 Jun 2014 10:01:52 +0000 (12:01 +0200)
committerXavier Morel <xmo@openerp.com>
Tue, 17 Jun 2014 10:01:52 +0000 (12:01 +0200)
commit79e10200d5cc78d39a139f63eb2a69309878ab04
tree3e9e640a14532d4e0af4abfc69d26a42451055ef
parent63a6ba92e2c0bade494ac05910210046e695b787
[IMP] prevent edition of page if groups which current user doesn't have

If the current view uses @groups attributes (possibly in called templates),
the corresponding elements are rendered to a void (empty string in qweb). If
said user can edit the page, does so and saves a view section in which there's
a @groups to which he has no access, the element[@groups] is completely
removed from the template once saved, losing it.

If QWeb encounters an @groups to which the current user has no right during
rendering, have it request a no-RTE page, so the user can not RTE-edit the
page (or drop snippets in it).
addons/website/static/src/js/website.editor.js
addons/website/static/src/xml/website.xml
addons/website/views/website_templates.xml
openerp/addons/base/ir/ir_qweb.py