[IMP] website_portal_medical_insurance: Improve security.

* Add create_uid to whitelist and to wizard * Fix groups_demo missing name field
LasLabs · Sep 16, 2017 · 5250dc9 · 5250dc9
1 parent 34487b4
commit 5250dc9
Show file tree

Hide file tree

Showing 4 changed files with 6 additions and 1 deletion.
diff --git a/website_portal_medical_insurance_us/controllers/main.py b/website_portal_medical_insurance_us/controllers/main.py
@@ -87,7 +87,9 @@ def insurance_plan_create_form(self, redirect=None, **kwargs):
         values = {
             'error': {},
             'error_message': [],
-            'success_page': kwargs.get('success_page', '/my/medical')
+            'success_page': kwargs.get(
+                'success_page', '/medical/insurance/plans'
+            )
         }
         plan = request.env['medical.insurance.plan'].browse()
         values.update({

diff --git a/website_portal_medical_insurance_us/data/ir_model_data.xml b/website_portal_medical_insurance_us/data/ir_model_data.xml
@@ -28,6 +28,7 @@
             'plan_id',
             'patient_name',
             'insurance_company_name',
+            'create_uid'
         ]"/>
     </function>
 

diff --git a/website_portal_medical_insurance_us/demo/res_groups_demo.xml b/website_portal_medical_insurance_us/demo/res_groups_demo.xml
@@ -5,6 +5,7 @@
 <odoo>
 
     <record id="group_medical_insurance_website" model="res.groups">
+        <field name="name">Group Medical Insurance Website</field>
         <field name="users" eval="[(4, ref('portal.demo_user0'))]" />
     </record>
 

diff --git a/website_portal_medical_insurance_us/wizards/website_medical_insurance_wizard.py b/website_portal_medical_insurance_us/wizards/website_medical_insurance_wizard.py
@@ -83,6 +83,7 @@ def _compute_insurance_company_id(self):
             if not company:
                 company = InsuranceCompanies.create({
                     'name': record.insurance_company_name,
+                    'create_uid': self.env.user.id,
                 })
             record.insurance_company_id = company[:1]