From 07a207c07c8252bccb0216b0716a2fd4f975f77d Mon Sep 17 00:00:00 2001 From: andreparames Date: Thu, 15 Sep 2016 07:15:34 +0100 Subject: [PATCH] [FIX] ETag value must be quote-delimited According to RFC 7232 # 2.3, an etag must be wrapped in double quotes: entity-tag = [ weak ] opaque-tag opaque-tag = DQUOTE *etagc DQUOTE etagc = %x21 / %x23-7E / obs-text ; VCHAR except double quotes, plus obs-text Odoo didn't properly quote etags, which could lead to stripping or failures when putting Odoo behind strict HTTP proxies. --- openerp/addons/base/ir/ir_http.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/openerp/addons/base/ir/ir_http.py b/openerp/addons/base/ir/ir_http.py index d8ece72e1b1..dde75a64a76 100644 --- a/openerp/addons/base/ir/ir_http.py +++ b/openerp/addons/base/ir/ir_http.py @@ -302,7 +302,7 @@ class ir_http(osv.AbstractModel): # cache etag = hasattr(request, 'httprequest') and request.httprequest.headers.get('If-None-Match') - retag = hashlib.md5(last_update).hexdigest() + retag = '"%s"' % hashlib.md5(last_update).hexdigest() status = status or (304 if etag == retag else 200) headers.append(('ETag', retag)) headers.append(('Cache-Control', 'max-age=%s' % (STATIC_CACHE if unique else 0)))