pengyuthon/odoo_source
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[FIX] base_import_module: CSRF handling

Browse Source 
* disabled CSRF protection for login route
* return CSRF token from login and retransmit it during module upload

``deploy`` only sends CSRF token if given one by authenticate so that
the command can be used for non-updated modules.

Closes #9488
This commit is contained in:
Xavier Morel
2016-01-12 19:05:43 +01:00
committed by Olivier Dony
parent 33299fd689
commit 045b9019ef
2 changed files with 17 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
addons/base_import_module/controllers/main.py
+4 -2
View File
@@ -21,7 +21,7 @@ class ImportModule(Controller):
if not is_admin:
raise openerp.exceptions.AccessError("Only administrators can upload a module")
@route('/base_import_module/login', type='http', auth='none', methods=['POST'])
@route('/base_import_module/login', type='http', auth='none', methods=['POST'], csrf=False)
@webservice
def login(self, login, password, db=None):
if db and db != request.db:
@@ -30,7 +30,9 @@ class ImportModule(Controller):
if not uid:
return Response(response="Wrong login/password", status=401)
self.check_user(uid)
return "ok"
return Response(headers={
'X-CSRF-TOKEN': request.csrf_token(),
})
@route('/base_import_module/upload', type='http', auth='user', methods=['POST'])
@webservice
openerp/cli/deploy.py
+13 -8
View File
@@ -17,21 +17,24 @@ class Deploy(Command):
def deploy_module(self, module_path, url, login, password, db='', force=False):
url = url.rstrip('/')
self.authenticate(url, login, password, db)
csrf_token = self.authenticate(url, login, password, db)
module_file = self.zip_module(module_path)
try:
return self.upload_module(url, module_file, force=force)
return self.upload_module(url, module_file, force=force, csrf_token=csrf_token)
finally:
os.remove(module_file)
def upload_module(self, server, module_file, force=False):
def upload_module(self, server, module_file, force=False, csrf_token=None):
print("Uploading module file...")
url = server + '/base_import_module/upload'
files = dict(mod_file=open(module_file, 'rb'))
force = '1' if force else ''
res = self.session.post(url, files=files, data=dict(force=force))
if res.status_code != 200:
raise Exception("Could not authenticate on server '%s'" % server)
post_data = {'force': '1' if force else ''}
if csrf_token: post_data['csrf_token'] = csrf_token
with open(module_file, 'rb') as f:
res = self.session.post(url, files={'mod_file': f}, data=post_data)
res.raise_for_status()
return res.text
def authenticate(self, server, login, password, db=''):
@@ -47,6 +50,8 @@ class Deploy(Command):
elif res.status_code != 200:
raise Exception(res.text)
return res.headers.get('x-csrf-token')
def zip_module(self, path):
path = os.path.abspath(path)
if not os.path.isdir(path):