Daily updates from Odoo
Wednesday, February 6, 2019
1 change · master
Security fixes and vulnerability patches
Users can now rate and comment on slide channels through a new website review popup, making course feedback easier to collect and display. The update also improves review statistics, lets users edit their own reviews, adds channel search, and strengthens posting security by using signed user tokens instead of exposing document access tokens.
Original PR description
Impacted modules: portal, rating, website_rating, website_slides This merge modifies the some aspect of posting a message for public document, in order to implement the rating (message+rating) on a slides channel. We now support the use case of posting without having the right to write on a document, and force the author of the message (as it is required to be logged to post a message). The security has been improved: to do so, the document token is not leaked anymore. Only the signed token (by current partner id) is used. The rating mixin has been modified to handle displaying average and count (per document), in an efficient way. A new frontend message composer is born in website_rating (as it allow to post a rating with a comment). To do so, a little refactoring of the Portal Chatter has been done. For more details, please have a look at the subcommits. They are well explained and correctly split. Task-1902304