From 04760491a2e7edc0448d359ea125e27f39d67c42 Mon Sep 17 00:00:00 2001
From: Xavier-Do <xdo@odoo.com>
Date: Tue, 2 May 2023 13:32:43 +0200
Subject: [PATCH] [FIX] runbot: hide wakeup action from public users

The initial idea to have a wakeup for public users stopped being viable
due to some abuse of the system, maybe unintentional crawling of
some build page but still, this feature will now be limited to internal
users only.
---
 runbot/controllers/frontend.py | 2 +-
 runbot/templates/utils.xml     | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/runbot/controllers/frontend.py b/runbot/controllers/frontend.py
index f6226095..e24d1c49 100644
--- a/runbot/controllers/frontend.py
+++ b/runbot/controllers/frontend.py
@@ -269,7 +269,7 @@ class Runbot(Controller):
 
     @o_route([
         '/runbot/build/<int:build_id>/<operation>',
-    ], type='http', auth="public", methods=['POST'], csrf=False)
+    ], type='http', auth="user", methods=['POST'], csrf=False)
     def build_operations(self, build_id, operation, **post):
         build = request.env['runbot.build'].sudo().browse(build_id)
         if operation == 'rebuild':
diff --git a/runbot/templates/utils.xml b/runbot/templates/utils.xml
index 670eb25e..2a52ee72 100644
--- a/runbot/templates/utils.xml
+++ b/runbot/templates/utils.xml
@@ -219,7 +219,7 @@
                     <a t-if="bu.static_run" t-att-href="bu.static_run" class="btn btn-info" title="View result" aria-label="View result">
                         <i class="fa fa-sign-in"/>
                     </a>
-                    <a t-if="bu.local_state=='done' and bu.requested_action != 'wake_up' and bu.database_ids" href="#" data-runbot="wakeup" t-att-data-runbot-build="bu.id" class="btn btn-default" title="Wake up this build" aria-label="Wake up this build">
+                    <a groups="base.group_user" t-if="bu.local_state=='done' and bu.requested_action != 'wake_up' and bu.database_ids" href="#" data-runbot="wakeup" t-att-data-runbot-build="bu.id" class="btn btn-default" title="Wake up this build" aria-label="Wake up this build">
                         <i class="fa fa-coffee"/>
                     </a>
                     <a t-attf-href="/runbot/build/{{bu['id']}}" class="btn btn-default" title="Build details" aria-label="Build details">