Merge lp:~therp-nl/openobject-addons/7.0_make_survey_module_usable_for_external_users into lp:openobject-addons/7.0

[Holger Brunn (Therp)]

The up to now proposed patch is dangerous because it assigns way to many permissions to the created user. This is an attempt to fix the issue in question and also add some minor usability improvements.

[lp:~therp-nl/openobject-addons/7.0_make_survey_module_usable_for_external_users]

9364. By Stefan Rijnhart (Opener) on 2013-10-25

[FIX] Prevent possibly unreferenced variable in invitation wizard
[FIX] Call invitation wizard with context in tests

Unmerged revisions

9364. By Stefan Rijnhart (Opener) on 2013-10-25

[FIX] Prevent possibly unreferenced variable in invitation wizard
[FIX] Call invitation wizard with context in tests

9363. By Holger Brunn (Therp) on 2013-08-15

[ADD] place invitees into their own group with appropriate access rights
[IMP] link created user to partner
[IMP] prefill timezone with user's timezone
[IMP] strip down survey form for invitees

=== modified file 'survey/__openerp__.py'
--- survey/__openerp__.py	2012-11-29 22:26:45 +0000
+++ survey/__openerp__.py	2013-10-25 11:13:01 +0000
@@ -36,12 +36,12 @@
     'author': 'OpenERP SA',
     'depends': ['mail'],
     'data': [
+        'security/survey_security.xml',
+        'security/ir.model.access.csv',
         'survey_report.xml',
         'survey_data.xml',
         'wizard/survey_selection.xml',
         'wizard/survey_answer.xml',
-        'security/survey_security.xml',
-        'security/ir.model.access.csv',
         'survey_view.xml',
         'wizard/survey_print_statistics.xml',
         'wizard/survey_print_answer.xml',

=== modified file 'survey/security/ir.model.access.csv'
--- survey/security/ir.model.access.csv	2012-03-07 05:47:59 +0000
+++ survey/security/ir.model.access.csv	2013-10-25 11:13:01 +0000
@@ -22,3 +22,13 @@
 access_survey_response_line_survey_user,survey.response.line.survey.user,model_survey_response_line,base.group_survey_user,1,1,1,1
 access_survey_question_column_heading_survey_user,survey.question.column.heading.survey.user,model_survey_question_column_heading,base.group_survey_user,1,0,0,0
 access_survey_question_column_heading_user,survey.question.column.heading user,model_survey_question_column_heading,base.group_tool_user,1,1,1,1
+access_survey_invitee,survey.invitee,model_survey,base.group_survey_invitee,1,0,0,0
+access_survey_page_invitee,survey.page.invitee,model_survey_page,base.group_survey_invitee,1,0,0,0
+access_survey_question_invitee,survey.question.invitee,model_survey_question,base.group_survey_invitee,1,0,0,0
+access_survey_answer_invitee,survey.answer.invitee,model_survey_answer,base.group_survey_invitee,1,0,0,0
+access_survey_response_invitee,survey.response.invitee,model_survey_response,base.group_survey_invitee,1,1,1,0
+access_survey_response_line_invitee,survey.response.line.invitee,model_survey_response_line,base.group_survey_invitee,1,1,1,0
+access_survey_response_answer_invitee,survey.response.answer.invitee,model_survey_response_answer,base.group_survey_invitee,1,1,1,0
+access_survey_history_invitee,survey.history.invitee,model_survey_history,base.group_survey_invitee,1,0,1,0
+access_survey_question_column_heading_invitee,survey.question.column.heading.invitee,model_survey_question_column_heading,base.group_survey_invitee,1,0,0,0
+access_res_partner_invitee,res.partner.invitee,base.model_res_partner,base.group_survey_invitee,1,0,0,0

=== modified file 'survey/security/survey_security.xml'
--- survey/security/survey_security.xml	2012-04-04 09:08:30 +0000
+++ survey/security/survey_security.xml	2013-10-25 11:13:01 +0000
@@ -15,5 +15,58 @@
             <field name="name">Survey / User</field>
             <field name="users" eval="[(4, ref('base.user_root'))]"/>
         </record>
-    </data>
+        <record model="res.groups" id="base.group_survey_invitee">
+            <field name="name">Survey / Invitee</field>
+        </record>
+	<record id="rule_survey_invitee" model="ir.rule">
+	    <field name="model_id" ref="model_survey" />
+	    <field name="domain_force">[("invited_user_ids", "=", user.id)]</field>
+	    <field name="groups" eval="[(6, 0,[ref('base.group_survey_invitee')])]" />
+	</record>
+	<record id="rule_survey_page_invitee" model="ir.rule">
+	    <field name="model_id" ref="model_survey_page" />
+	    <field name="domain_force">[("survey_id.invited_user_ids", "=", user.id)]</field>
+	    <field name="groups" eval="[(6, 0,[ref('base.group_survey_invitee')])]" />
+	</record>
+	<record id="rule_survey_question_invitee" model="ir.rule">
+	    <field name="model_id" ref="model_survey_question" />
+	    <field name="domain_force">[("survey.invited_user_ids", "=", user.id)]</field>
+	    <field name="groups" eval="[(6, 0,[ref('base.group_survey_invitee')])]" />
+	</record>
+	<record id="rule_survey_answer_invitee" model="ir.rule">
+	    <field name="model_id" ref="model_survey_answer" />
+	    <field name="domain_force">[("question_id.survey.invited_user_ids", "=", user.id)]</field>
+	    <field name="groups" eval="[(6, 0,[ref('base.group_survey_invitee')])]" />
+	</record>
+	<record id="rule_survey_response_invitee" model="ir.rule">
+	    <field name="model_id" ref="model_survey_response" />
+	    <field name="domain_force">[("user_id", "=", user.id)]</field>
+	    <field name="groups" eval="[(6, 0,[ref('base.group_survey_invitee')])]" />
+	</record>
+	<record id="rule_survey_response_line_invitee" model="ir.rule">
+	    <field name="model_id" ref="model_survey_response_line" />
+	    <field name="domain_force">[("response_id.user_id", "=", user.id)]</field>
+	    <field name="groups" eval="[(6, 0,[ref('base.group_survey_invitee')])]" />
+	</record>
+	<record id="rule_survey_response_answer_invitee" model="ir.rule">
+	    <field name="model_id" ref="model_survey_response_answer" />
+	    <field name="domain_force">[("response_id.response_id.user_id", "=", user.id)]</field>
+	    <field name="groups" eval="[(6, 0,[ref('base.group_survey_invitee')])]" />
+	</record>
+	<record id="rule_survey_history_invitee" model="ir.rule">
+	    <field name="model_id" ref="model_survey_history" />
+	    <field name="domain_force">[("survey_id.invited_user_ids", "=", user.id)]</field>
+	    <field name="groups" eval="[(6, 0,[ref('base.group_survey_invitee')])]" />
+	</record>
+	<record id="rule_survey_question_column_heading_invitee" model="ir.rule">
+	    <field name="model_id" ref="model_survey_question_column_heading" />
+	    <field name="domain_force">[("question_id.survey.invited_user_ids", "=", user.id)]</field>
+	    <field name="groups" eval="[(6, 0,[ref('base.group_survey_invitee')])]" />
+	</record>
+	<record id="rule_res_partner_invitee" model="ir.rule">
+	    <field name="model_id" ref="base.model_res_partner" />
+	    <field name="domain_force">[("id", "=", user.id)]</field>
+	    <field name="groups" eval="[(6, 0,[ref('base.group_survey_invitee')])]" />
+	</record>
+     </data>
 </openerp>

=== modified file 'survey/survey_report.xml'
--- survey/survey_report.xml	2012-06-28 06:40:05 +0000
+++ survey/survey_report.xml	2013-10-25 11:13:01 +0000
@@ -6,20 +6,23 @@
                 id="report_survey_form"
                 model="survey"
                 name="survey.form"
-                string="Survey"/>
+                string="Survey"
+                groups="base.group_survey_user" />
 
         <report auto="True"
                 id="survey_analysis"
                 model="survey"
                 name="survey.analysis"
                 rml=""
-                string="Survey Statistics"/>
+                string="Survey Statistics"
+                groups="base.group_survey_user" />
 
         <report auto="True"
                 id="survey_browse_response"
                 model="survey"
                 name="survey.browse.response"
                 rml=""
-                string="Survey Answers"/>
+                string="Survey Answers"
+                groups="base.group_survey_user" />
     </data>
 </openerp>

=== modified file 'survey/survey_view.xml'
--- survey/survey_view.xml	2013-06-11 10:02:43 +0000
+++ survey/survey_view.xml	2013-10-25 11:13:01 +0000
@@ -268,6 +268,35 @@
             </field>
         </record>
 
+        <record model="ir.ui.view" id="survey_form_invitee">
+            <field name="name">survey_form_invitee</field>
+            <field name="model">survey</field>
+            <field name="groups_id" eval="[(6, 0, [ref('base.group_survey_invitee')])]" />
+            <field name="priority" eval="1" />
+            <field name="inherit_id" ref="survey_form" />
+            <field name="arch" type="xml">
+                <data>
+                    <form position="replace">
+                        <form string="Survey" version="7.0">
+                            <sheet>
+                                <field name="state" invisible="True" />
+                                <div class="oe_button_box oe_right">
+                                    <button name="fill_survey" states="open" string="Answer Survey" type="object" icon="gtk-execute" context="{'survey_id': active_id}" attrs="{'invisible':[('state','!=','open')]}"/>
+                                </div>
+                                <div class="oe_title">
+                                    <label for="title" class="oe_edit_only"/>
+                                    <h1>
+                                        <field name="title" attrs="{'readonly':[('state','=','close')]}"/>
+                                    </h1>
+                                </div>
+                                <field name="note" />
+                            </sheet>
+                        </form>
+                    </form>
+                </data>
+            </field>
+        </record>
+ 
         <record id="survey_search" model="ir.ui.view">
             <field name="name">survey_search</field>
             <field name="model">survey</field>
@@ -1224,14 +1253,16 @@
             id="act_survey_pages"
             name="Pages"
             res_model="survey.page"
-            src_model="survey"/>
+            src_model="survey"
+            groups="base.group_survey_user"/>
 
         <act_window
             context="{'search_default_survey': active_id, 'default_survey': active_id}"
             id="act_survey_question"
             name="Questions"
             res_model="survey.question"
-            src_model="survey"/>
+            src_model="survey"
+            groups="base.group_survey_user"/>
 
 
         <act_window
@@ -1239,7 +1270,7 @@
             id="act_survey_page_question"
             name="Questions"
             res_model="survey.question"
-            src_model="survey.page"/>
+            src_model="survey.page" />
 
         <act_window domain="[('question_id', '=', active_id)]"
             id="act_survey_answer"
@@ -1252,7 +1283,8 @@
             id="act_survey_request"
             name="Survey Requests"
             res_model="survey.request"
-            src_model="survey"/>
+            src_model="survey"
+            groups="base.group_survey_user"/>
 
     </data>
 </openerp>

=== modified file 'survey/test/draft2open2close_survey.yml'
--- survey/test/draft2open2close_survey.yml	2011-12-20 16:03:42 +0000
+++ survey/test/draft2open2close_survey.yml	2013-10-25 11:13:01 +0000
@@ -82,7 +82,7 @@
     context = {'active_model':'survey', 'active_id': ref('survey_Initial_partner_feedback'), 'active_ids': [ref('survey_Initial_partner_feedback')]}
     values = self.default_get(cr, uid, ['mail_from', 'mail_subject', 'send_mail_existing', 'mail_subject_existing', 'mail', 'partner_ids', 'send_mail'], context)
     values['mail_from'] = 'Surveyor'
-    new_id = self.create(cr, uid, values)
+    new_id = self.create(cr, uid, values, context)
     self.action_send(cr, uid, [new_id], context)
 -
   I set the value in "Total start survey" field.

=== modified file 'survey/wizard/survey_answer.py'
--- survey/wizard/survey_answer.py	2013-09-20 12:39:38 +0000
+++ survey/wizard/survey_answer.py	2013-10-25 11:13:01 +0000
@@ -27,7 +27,7 @@
 
 from openerp import addons, netsvc, tools
 from openerp.osv import fields, osv
-from openerp.tools import to_xml
+from openerp.tools import to_xml, SUPERUSER_ID
 from openerp.tools.translate import _
 from openerp.tools.safe_eval import safe_eval
 
@@ -124,7 +124,7 @@
                                 raise osv.except_osv(_('Warning!'),_("You cannot answer this survey more than %s times.") % (user_limit))
 
                         if sur_rec.max_response_limit and sur_rec.max_response_limit <= sur_rec.tot_start_survey and not sur_name_rec.page_no + 1:
-                            survey_obj.write(cr, uid, survey_id, {'state':'close', 'date_close':strftime("%Y-%m-%d %H:%M:%S")})
+                            survey_obj.write(cr, SUPERUSER_ID, survey_id, {'state':'close', 'date_close':strftime("%Y-%m-%d %H:%M:%S")})
 
                         p_id = p_id[sur_name_rec.page_no + 1]
                         surv_name_wiz.write(cr, uid, [context['sur_name_id'],], {'page_no' : sur_name_rec.page_no + 1})
@@ -397,8 +397,8 @@
                     result['fields'] = fields
                     result['context'] = context
                 else:
-                    survey_obj.write(cr, uid, survey_id, {'tot_comp_survey' : sur_rec.tot_comp_survey + 1})
-                    sur_response_obj.write(cr, uid, [sur_name_read.response], {'state' : 'done'})
+                    survey_obj.write(cr, SUPERUSER_ID, survey_id, {'tot_comp_survey' : sur_rec.tot_comp_survey + 1})
+                    sur_response_obj.write(cr, uid, int(sur_name_read.response), {'state' : 'done'})
 
                     # mark the survey request as done; call 'survey_req_done' on its actual model
                     survey_req_obj = self.pool.get(context.get('active_model'))
@@ -606,7 +606,7 @@
                                               'date': strftime('%Y-%m-%d %H:%M:%S'), 'survey_id': sur_name_read['survey_id'][0]})
             survey_id = sur_name_read['survey_id'][0]
             sur_rec = survey_obj.read(cr, uid, survey_id)
-            survey_obj.write(cr, uid, survey_id,  {'tot_start_survey' : sur_rec['tot_start_survey'] + 1})
+            survey_obj.write(cr, SUPERUSER_ID, survey_id,  {'tot_start_survey' : sur_rec['tot_start_survey'] + 1})
             if context.has_key('cur_id'):
                 if context.has_key('request') and context.get('request',False):
                     self.pool.get(context.get('object',False)).write(cr, uid, [int(context.get('cur_id',False))], {'response' : response_id})

=== modified file 'survey/wizard/survey_send_invitation.py'
--- survey/wizard/survey_send_invitation.py	2012-12-06 14:56:32 +0000
+++ survey/wizard/survey_send_invitation.py	2013-10-25 11:13:01 +0000
@@ -60,6 +60,7 @@
         survey_obj = self.pool.get('survey')
         msg = ""
         name = ""
+        survey_id = 0
         for sur in survey_obj.browse(cr, uid, context.get('active_ids', []), context=context):
             name += "\n --> " + sur.title + "\n"
             if sur.state != 'open':
@@ -67,6 +68,7 @@
             data['mail_subject'] = _("Invitation for %s") % (sur.title)
             data['mail_subject_existing'] = _("Invitation for %s") % (sur.title)
             data['mail_from'] = sur.responsible_id.email
+            survey_id = sur.id
         if msg:
             raise osv.except_osv(_('Warning!'), _('The following surveys are not in open state: %s') % msg)
         data['mail'] = _('''
@@ -77,7 +79,12 @@
  Your login ID: %%(login)s\n
  Your password: %%(passwd)s\n
 \n\n
-Thanks,''') % (name, self.pool.get('ir.config_parameter').get_param(cr, uid, 'web.base.url', default='http://localhost:8069', context=context))
+Thanks,''') % (
+            name, 
+            self.pool.get('ir.config_parameter').get_param(
+                cr, uid, 'web.base.url', default='http://localhost:8069',
+                context=context)
+                + '#id=%d&view_type=form&model=survey' % survey_id)
         return data
 
     def create_report(self, cr, uid, res_ids, report_name=False, file_name=False):
@@ -108,8 +115,8 @@
         mail_message = self.pool.get('mail.message')
 
         model_data_obj = self.pool.get('ir.model.data')
-        group_id = model_data_obj._get_id(cr, uid, 'base', 'group_survey_user')
-        group_id = model_data_obj.browse(cr, uid, group_id, context=context).res_id
+        group_id = model_data_obj.get_object_reference(
+                cr, uid, 'base', 'group_survey_invitee')[1]
 
         act_id = self.pool.get('ir.actions.act_window')
         act_id = act_id.search(cr, uid, [('res_model', '=' , 'survey.name.wiz'), \
@@ -188,7 +195,9 @@
                                 'address_id': partner.id,
                                 'groups_id': [[6, 0, [group_id]]],
                                 'action_id': act_id[0],
-                                'survey_id': [[6, 0, survey_ids]]
+                                'survey_id': [[6, 0, survey_ids]],
+                                'partner_id': partner.id,
+                                'tz': context.get('tz'),
                                }
                     user = user_ref.create(cr, uid, res_data)
                     if user not in new_user:

=== modified file 'survey/wizard/survey_send_invitation.xml'
--- survey/wizard/survey_send_invitation.xml	2012-11-29 22:26:45 +0000
+++ survey/wizard/survey_send_invitation.xml	2013-10-25 11:13:01 +0000
@@ -45,7 +45,8 @@
         <act_window id="action_act_view_survey_send_invitation"
             key2="client_action_multi" name="Send Invitations"
             res_model="survey.send.invitation" src_model="survey"
-            view_mode="form" target="new" view_type="form" />
+            view_mode="form" target="new" view_type="form"
+            groups="base.group_survey_user"/>
 
         <!-- Survey send invitation Display Log Form View -->