[FIX] survey: Don't disclose the survey via print.

[mvaled]

The contents of a survey could be disclosed through the print method. This PR fix this issue.

I read the Responsible Disclosure of Odoo Security Vulnerabilities document, and I found this issue not be worthy of the process described there.

--
I confirm I have signed the CLA and read the PR guidelines at www.odoo.com/submit-pr

[mvaled]

The CLA of Larisa was signed in a previous PR #29737, but that has not been merged yet.

[mart-e]

Hi,

It looks good to me but just to be sure, @rim-odoo do you agree too?

[mart-e]

Hi again,

Sorry but actually, your patch introduces a change of behaviour (which should not happen in a stable version), you could no longer print a closed survey.

Instead, we could only check if the survey has auth_required enabled and make sure the user is not public.
Could you update?

[mvaled]

Hi @mart-e

I propose to add a 'allow_closed' argument to the method _check_bad_cases. So can still use it but allow to print closed surveys. By default it keeps the old behavior.

Is that acceptable?

[mvaled]

Sorry I didn't realized you forced a push before. I will rebase onto 10.0.

[mart-e]

We try not to change the signatures of methods in stable versions.
What do you wish to prevent exactly? Isn't the auth part enough?

We know the survey module is not the best and we plan to refactor it in the future but in 10.0, we try to keep the changes to the minimal (it is an end of life version).
If you want to make larger changes, it should probably target the master version instead.

[mvaled]

Ok. Changed.

[MiquelRForgeFlow]

@tde-banana-odoo

[mart-e]

Thanks for the update !

robodoo r+

[robodoo]

Staging failed: ci/runbot on a774b02dbe4d07ed8b1d1210e9acf025c9dc241f (view more at http://runbot.odoo.com/runbot/build/428749)

[mart-e]

robodoo retry

[robodoo]

Staging failed: ci/runbot on d355ccc202296b532ba128859785487acc11e1a2 (view more at http://runbot.odoo.com/runbot/build/428810)