From 3a1ed80b4155f11f5db690eed584925ba6ea534d Mon Sep 17 00:00:00 2001
From: Xavier Morel <xmo@openerp.com>
Date: Wed, 30 Oct 2013 14:30:19 +0100
Subject: [PATCH] [FIX] creation of new products from products listing page

* fix creation controller to redirect to the id of the *product
  template* implicitly created when the product is created, not to the
  product, as "product" URLs actually display information about a
  product template
* ensure the controller is only POST-ed to, not GET
* fix button to POST the creation request (use form and actual button,
  not link)
* fix template (foreach -> t-foreach)

bzr revid: xmo@openerp.com-20131030133019-5pq3qekwu465x1k6
---
 addons/website_sale/controllers/main.py    | 23 +++++++++++++++-------
 addons/website_sale/views/website_sale.xml |  7 +++++--
 2 files changed, 21 insertions(+), 9 deletions(-)

diff --git a/addons/website_sale/controllers/main.py b/addons/website_sale/controllers/main.py
index 193bb079191..c089f54939c 100644
--- a/addons/website_sale/controllers/main.py
+++ b/addons/website_sale/controllers/main.py
@@ -1,14 +1,16 @@
 # -*- coding: utf-8 -*-
+import random
+import uuid
+import urllib
+import simplejson
+
+import werkzeug.exceptions
 
 from openerp import SUPERUSER_ID
 from openerp.osv import osv
 from openerp.addons.web import http
 from openerp.addons.web.http import request
 from openerp.addons.website.models import website
-import random
-import uuid
-import urllib
-import simplejson
 
 def get_order(order_id=None):
     order_obj = request.registry.get('sale.order')
@@ -358,9 +360,16 @@ class Ecommerce(http.Controller):
 
     @website.route(['/shop/add_product/', '/shop/category/<int:cat_id>/add_product/'], type='http', auth="public", multilang=True)
     def add_product(self, cat_id=0, **post):
-        product_id = request.registry.get('product.product').create(request.cr, request.uid,
-            {'name': 'New Product', 'public_categ_id': cat_id}, request.context)
-        return request.redirect("/shop/product/%s/?enable_editor=1" % product_id)
+        if request.httprequest.method != 'POST':
+            return werkzeug.exceptions.MethodNotAllowed(valid_methods=['POST'])
+
+        Product = request.registry.get('product.product')
+        product_id = Product.create(request.cr, request.uid, {
+            'name': 'New Product', 'public_categ_id': cat_id
+        }, context=request.context)
+        product = Product.browse(request.cr, request.uid, product_id, context=request.context)
+
+        return request.redirect("/shop/product/%s/?enable_editor=1" % product.product_tmpl_id.id)
 
     def get_pricelist(self):
         if not request.httprequest.session.get('ecommerce_pricelist'):
diff --git a/addons/website_sale/views/website_sale.xml b/addons/website_sale/views/website_sale.xml
index 3f0435e2b32..4e3c01fb44b 100644
--- a/addons/website_sale/views/website_sale.xml
+++ b/addons/website_sale/views/website_sale.xml
@@ -78,7 +78,10 @@
               <div class="container oe_website_sale">
                 <div class="row">
                     <div class="col-sm-6 pagination" style="padding-left: 15px;">
-                        <a t-if="editable" t-href="/shop/add_product/" class="btn btn-primary btn-default" t-keep-query="category,search,facettes">New Product</a>
+                        <form t-if="editable" t-keep-query="category,search,facettes"
+                              method="POST" t-action="/shop/add_product">
+                            <button class="btn btn-primary">New Product</button>
+                        </form>
                     </div>
                     <div class="col-sm-6">
                         <t t-call="website.pager">
@@ -250,7 +253,7 @@
                       <form t-action="/shop/" method="get" class="pull-right" t-keep-query="category,facettes">
                           <div class="input-group">
                               <t t-if="search">
-                              <t foreach="search.items()" t-as="key">
+                              <t t-foreach="search.items()" t-as="key">
                                   <input t-att-name="key[0]" t-att-value="key[1]"/>
                               </t>
                               </t>