[FIX] website_forum: restrict a bunch of controllers to POST-only, convert a few...

diff --git a/addons/website_forum/controllers/main.py b/addons/website_forum/controllers/main.py
index cd36a80..8fa7922 100644 (file)
--- a/addons/website_forum/controllers/main.py
+++ b/addons/website_forum/controllers/main.py
@@ -73,7 +73,7 @@ class WebsiteForum(http.Controller):
         forums = Forum.browse(cr, uid, obj_ids, context=context)
         return request.website.render("website_forum.forum_all", {'forums': forums})
 
-    @http.route('/forum/new', type='http', auth="user", multilang=True, website=True)
+    @http.route('/forum/new', type='http', auth="user", methods=['POST'], multilang=True, website=True)
     def forum_create(self, forum_name="New Forum", **kwargs):
         forum_id = request.registry['forum.forum'].create(request.cr, request.uid, {
             'name': forum_name,
@@ -220,7 +220,7 @@ class WebsiteForum(http.Controller):
         request.registry['forum.post'].write(request.cr, request.uid, [question.id], {'favourite_ids': favourite_ids}, context=request.context)
         return favourite
 
-    @http.route('/forum/<model("forum.forum"):forum>/question/<model("forum.post"):question>/ask_for_close', type='http', auth="user", multilang=True, website=True)
+    @http.route('/forum/<model("forum.forum"):forum>/question/<model("forum.post"):question>/ask_for_close', type='http', auth="user", methods=['POST'], multilang=True, website=True)
     def question_ask_for_close(self, forum, question, **post):
         check_res = self._has_enough_karma(question.create_uid.id == request.uid and '_karma_modo_close_own' or '_karma_modo_close_all')
         if not check_res[0]:
@@ -261,7 +261,7 @@ class WebsiteForum(http.Controller):
         }, context=request.context)
         return werkzeug.utils.redirect("/forum/%s/question/%s" % (slug(forum), slug(question)))
 
-    @http.route('/forum/<model("forum.forum"):forum>/question/<model("forum.post"):question>/reopen', type='http', auth="user", multilang=True, website=True)
+    @http.route('/forum/<model("forum.forum"):forum>/question/<model("forum.post"):question>/reopen', type='http', auth="user", methods=['POST'], multilang=True, website=True)
     def question_reopen(self, forum, question, **kwarg):
         check_res = self._has_enough_karma(question.create_uid.id == request.uid and '_karma_modo_close_own' or '_karma_modo_close_all')
         if not check_res[0]:
@@ -270,7 +270,7 @@ class WebsiteForum(http.Controller):
         request.registry['forum.post'].write(request.cr, request.uid, [question.id], {'state': 'active'}, context=request.context)
         return werkzeug.utils.redirect("/forum/%s/question/%s" % (slug(forum), slug(question)))
 
-    @http.route('/forum/<model("forum.forum"):forum>/question/<model("forum.post"):question>/delete', type='http', auth="user", multilang=True, website=True)
+    @http.route('/forum/<model("forum.forum"):forum>/question/<model("forum.post"):question>/delete', type='http', auth="user", methods=['POST'], multilang=True, website=True)
     def question_delete(self, forum, question, **kwarg):
         check_res = self._has_enough_karma(question.create_uid.id == request.uid and '_karma_modo_unlink_own' or '_karma_modo_unlink_all')
         if not check_res[0]:
@@ -279,7 +279,7 @@ class WebsiteForum(http.Controller):
         request.registry['forum.post'].write(request.cr, request.uid, [question.id], {'active': False}, context=request.context)
         return werkzeug.utils.redirect("/forum/%s/question/%s" % (slug(forum), slug(question)))
 
-    @http.route('/forum/<model("forum.forum"):forum>/question/<model("forum.post"):question>/undelete', type='http', auth="user", multilang=True, website=True)
+    @http.route('/forum/<model("forum.forum"):forum>/question/<model("forum.post"):question>/undelete', type='http', auth="user", methods=['POST'], multilang=True, website=True)
     def question_undelete(self, forum, question, **kwarg):
         check_res = self._has_enough_karma(question.create_uid.id == request.uid and '_karma_modo_unlink_own' or '_karma_modo_unlink_all')
         if not check_res[0]:
@@ -338,7 +338,7 @@ class WebsiteForum(http.Controller):
         request.registry['forum.post'].write(cr, uid, [post.id], {'is_correct': not post.is_correct}, context=context)
         return not post.is_correct
 
-    @http.route('/forum/<model("forum.forum"):forum>/post/<model("forum.post"):post>/delete', type='http', auth="user", multilang=True, website=True)
+    @http.route('/forum/<model("forum.forum"):forum>/post/<model("forum.post"):post>/delete', type='http', auth="user", methods=['POST'], multilang=True, website=True)
     def post_delete(self, forum, post, **kwargs):
         check_res = self._has_enough_karma(post.create_uid.id == request.uid and '_karma_modo_unlink_own' or '_karma_modo_unlink_all')
         if not check_res[0]:
@@ -548,7 +548,7 @@ class WebsiteForum(http.Controller):
         })
         return request.website.render("website_forum.edit_profile", values)
 
-    @http.route('/forum/<model("forum.forum"):forum>/user/<model("res.users"):user>/save', type='http', auth="user", multilang=True, website=True)
+    @http.route('/forum/<model("forum.forum"):forum>/user/<model("res.users"):user>/save', type='http', auth="user", methods=['POST'], multilang=True, website=True)
     def save_edited_profile(self, forum, user, **kwargs):
         request.registry['res.users'].write(request.cr, request.uid, [user.id], {
             'name': kwargs.get('name'),
@@ -589,7 +589,7 @@ class WebsiteForum(http.Controller):
     # Messaging
     # --------------------------------------------------
 
-    @http.route('/forum/<model("forum.forum"):forum>/post/<model("forum.post"):post>/comment/<model("mail.message"):comment>/convert_to_answer', type='http', auth="public", multilang=True, website=True)
+    @http.route('/forum/<model("forum.forum"):forum>/post/<model("forum.post"):post>/comment/<model("mail.message"):comment>/convert_to_answer', type='http', auth="public", methods=['POST'], multilang=True, website=True)
     def convert_comment_to_answer(self, forum, post, comment, **kwarg):
         body = comment.body
         request.registry['mail.message'].unlink(request.cr, request.uid, [comment.id], context=request.context)
@@ -599,7 +599,7 @@ class WebsiteForum(http.Controller):
                 return self.post_comment(forum, answer, comment=html2plaintext(body))
         return self.post_new(forum, question, content=body)
 
-    @http.route('/forum/<model("forum.forum"):forum>/post/<model("forum.post"):post>/convert_to_comment', type='http', auth="user", multilang=True, website=True)
+    @http.route('/forum/<model("forum.forum"):forum>/post/<model("forum.post"):post>/convert_to_comment', type='http', auth="user", methods=['POST'], multilang=True, website=True)
     def convert_answer_to_comment(self, forum, post, **kwarg):
         values = {
             'comment': html2plaintext(post.content),

diff --git a/addons/website_forum/views/website_forum.xml b/addons/website_forum/views/website_forum.xml
index 75b9fcb..0e0ada6 100644 (file)
--- a/addons/website_forum/views/website_forum.xml
+++ b/addons/website_forum/views/website_forum.xml
@@ -21,9 +21,9 @@
 </template>
 
 <!-- helper -->
-<template id="muted_button">
+<template id="link_button">
     <form method="POST" t-att-action="url">
-        <button t-attf-class="text-muted fa btn-link #{classes}">
+        <button t-attf-class="fa btn-link #{classes}">
             <t t-esc="label"/></button>
     </form>
 </template>
@@ -440,7 +440,11 @@
                         on <span t-field="question.closed_date"/></b>
                     </p>
                     <div t-if="question.state == 'close' and user.karma&gt;=500" class="mb24 text-center">
-                        <a class="fa fa-arrow-right" t-attf-href="/forum/#{ slug(forum) }/question/#{slug(question)}/reopen"> Reopen</a>
+                        <t t-call="website_forum.link_button">
+                            <t t-set="url"><t t-escf="/forum/#{ slug(forum) }/question/#{slug(question)}/reopen"/></t>
+                            <t t-set="label"> Reopen</t>
+                            <t t-set="classes">fa-arrow-right</t>
+                        </t>
                     </div>
                 </div>
                 <t t-raw="question.content"/>
@@ -460,19 +464,39 @@
                                 </a>
                             </li>
                             <li t-if="question.state != 'close' and ((user.id == question.create_uid.id and can_close_own) or can_close_all)">
-                                <a class="text-muted fa fa-times" t-attf-href="/forum/#{ slug(forum) }/question/#{slug(question)}/ask_for_close"> Close</a>
+                                <t t-call="website_forum.link_button">
+                                    <t t-set="url"><t t-escf="/forum/#{ slug(forum) }/question/#{slug(question)}/ask_for_close"/></t>
+                                    <t t-set="label"> Close</t>
+                                    <t t-set="classes">text-muted fa-times</t>
+                                </t>
                             </li>
                             <li t-if="question.state == 'close' and ((user.id == question.create_uid.id and can_close_own) or can_close_all)">
-                                <a class="text-muted fa fa-undo" t-attf-href="/forum/#{ slug(forum) }/question/#{slug(question)}/reopen"> Reopen</a>
+                                <t t-call="website_forum.link_button">
+                                    <t t-set="url"><t t-escf="/forum/#{ slug(forum) }/question/#{slug(question)}/reopen"/></t>
+                                    <t t-set="label"> Reopen</t>
+                                    <t t-set="classes">text-muted fa-undo</t>
+                                </t>
                             </li>
                             <li t-if="(user.id == question.create_uid.id and can_edit_own) or can_edit_all">
-                                <a class="text-muted fa fa-edit" t-attf-href="/forum/#{ slug(forum) }/post/#{slug(question)}/edit"> Edit</a>
+                                <t t-call="website_forum.link_button">
+                                    <t t-set="url"><t t-escf="/forum/#{ slug(forum) }/post/#{slug(question)}/edit"/></t>
+                                    <t t-set="label"> Edit</t>
+                                    <t t-set="classes">text-muted fa-edit</t>
+                                </t>
                             </li>
                             <li t-if="question.active and ((user.id == question.create_uid.id and can_unlink_own) or can_unlink_all)">
-                                <a class="text-muted fa fa-trash-o" t-attf-href="/forum/#{ slug(forum) }/question/#{slug(question)}/delete"> Delete</a>
+                                <t t-call="website_forum.link_button">
+                                    <t t-set="url"><t t-escf="/forum/#{ slug(forum) }/question/#{slug(question)}/delete"/></t>
+                                    <t t-set="label"> Delete</t>
+                                    <t t-set="classes">text-muted fa-trash-o</t>
+                                </t>
                             </li>
                             <li t-if="not question.active and ((user.id == question.create_uid.id and can_unlink_own) or can_unlink_all)">
-                                <a class="text-muted fa fa-trash-o" t-attf-href="/forum/#{ slug(forum) }/question/#{slug(question)}/undelete"> Undelete</a>
+                                <t t-call="website_forum.link_button">
+                                    <t t-set="url"><t t-escf="/forum/#{ slug(forum) }/question/#{slug(question)}/undelete"/></t>
+                                    <t t-set="label"> Undelete</t>
+                                    <t t-set="classes">text-muted fa-trash-o</t>
+                                </t>
                             </li>
                         </ul>
                     </div>
@@ -519,17 +543,17 @@
                                 <a class="text-muted fa fa-edit" t-attf-href="/forum/#{slug(forum)}/post/#{slug(answer)}/edit"> Edit</a>
                             </li>
                             <li t-if="(user.id == answer.create_uid.id and can_unlink_own) or can_unlink_all">
-                                <t t-call="website_forum.muted_button">
+                                <t t-call="website_forum.link_button">
                                     <t t-set="url"><t t-escf="/forum/#{slug(forum)}/post/#{slug(answer)}/delete"/></t>
                                     <t t-set="label"> Delete</t>
-                                    <t t-set="classes">fa-trash-o</t>
+                                    <t t-set="classes">text-muted fa-trash-o</t>
                                 </t>
                             </li>
                             <li t-if="user.id == answer.create_uid.id">
-                                <t t-call="website_forum.muted_button">
+                                <t t-call="website_forum.link_button">
                                     <t t-set="url"><t t-escf="/forum/#{slug(forum)}/post/#{slug(answer)}/convert_to_comment"/></t>
                                     <t t-set="label">Convert as a comment</t>
-                                    <t t-set="classes">fa-magic</t>
+                                    <t t-set="classes">text-muted fa-magic</t>
                                 </t>
                             </li>
                         </ul>
@@ -574,10 +598,10 @@
                         style="display: inline-block;"/>
                     on <span t-field="message.date" t-field-options='{"format":"short"}'/>
 
-                    <t t-call="website_forum.muted_button">
+                    <t t-call="website_forum.link_button">
                         <t t-set="url"><t t-escf="/forum/#{slug(forum)}/post/#{slug(object)}/comment/#{slug(message)}/convert_to_answer"/></t>
                         <t t-set="label"> Convert as an answer</t>
-                        <t t-set="classes">fa-magic pull-right</t>
+                        <t t-set="classes">text-muted fa-magic pull-right</t>
                     </t>
                 </small>
             </div>