[REV] im_livechat, mail: remove cors from discuss route overrides

This PR removes the livechat's discuss route overrides
that added `cors="*"` since they are not safe (different databases on our
cloud are considered as SameSite).

In the meantime, embed livechats won't work as expected since cors is
prevented and will be fixed in a following PR.

closes odoo/odoo#135260

Signed-off-by: Sébastien Theys (seb) <seb@odoo.com>

addons/im_livechat/controllers/__init__.py

@@ -1,11 +1,6 @@
 # -*- coding: utf-8 -*-
 # Part of Odoo. See LICENSE file for full copyright and licensing details.
 
-from . import channel
 from . import chatbot
-from . import link_preview
 from . import main
-from . import message_reaction
-from . import rtc
-from . import thread
 from . import webclient

addons/im_livechat/controllers/channel.py

@@ -1,12 +0,0 @@
-# Part of Odoo. See LICENSE file for full copyright and licensing details.
-
-from odoo.http import route
-from odoo.addons.mail.controllers.discuss.channel import ChannelController
-from odoo.addons.mail.models.discuss.mail_guest import add_guest_to_context
-
-
-class LivechatChannelController(ChannelController):
-    @route("/discuss/channel/messages", cors="*")
-    @add_guest_to_context
-    def discuss_channel_messages(self, channel_id, before=None, after=None, limit=30, around=None):
-        return super().discuss_channel_messages(channel_id, before, after, limit, around)

addons/im_livechat/controllers/link_preview.py

@@ -1,17 +0,0 @@
-# Part of Odoo. See LICENSE file for full copyright and licensing details.
-
-from odoo.http import route
-from odoo.addons.mail.controllers.link_preview import LinkPreviewController
-from odoo.addons.mail.models.discuss.mail_guest import add_guest_to_context
-
-
-class LivechatLinkPreviewController(LinkPreviewController):
-    @route("/mail/link_preview", cors="*")
-    @add_guest_to_context
-    def mail_link_preview(self, message_id, clear=None):
-        return super().mail_link_preview(message_id, clear)
-
-    @route("/mail/link_preview/delete", cors="*")
-    @add_guest_to_context
-    def mail_link_preview_delete(self, link_preview_id):
-        return super().mail_link_preview_delete(link_preview_id)

addons/im_livechat/controllers/message_reaction.py

@@ -1,12 +0,0 @@
-# Part of Odoo. See LICENSE file for full copyright and licensing details.
-
-from odoo.http import route
-from odoo.addons.mail.controllers.message_reaction import MessageReactionController
-from odoo.addons.mail.models.discuss.mail_guest import add_guest_to_context
-
-
-class LivechatReactionController(MessageReactionController):
-    @route("/mail/message/reaction", cors="*")
-    @add_guest_to_context
-    def mail_message_add_reaction(self, message_id, content, action):
-        return super().mail_message_add_reaction(message_id, content, action)

addons/im_livechat/controllers/rtc.py

@@ -1,32 +0,0 @@
-# Part of Odoo. See LICENSE file for full copyright and licensing details.
-
-from odoo.http import route
-from odoo.addons.mail.models.discuss.mail_guest import add_guest_to_context
-from odoo.addons.mail.controllers.discuss.rtc import RtcController
-
-
-class LivechatRtcController(RtcController):
-    @route("/mail/rtc/session/notify_call_members", cors="*")
-    @add_guest_to_context
-    def session_call_notify(self, peer_notifications):
-        return super().session_call_notify(peer_notifications)
-
-    @route("/mail/rtc/session/update_and_broadcast", cors="*")
-    @add_guest_to_context
-    def session_update_and_broadcast(self, session_id, values):
-        return super().session_update_and_broadcast(session_id, values)
-
-    @route("/mail/rtc/channel/join_call", cors="*")
-    @add_guest_to_context
-    def channel_call_join(self, channel_id, check_rtc_session_ids=None):
-        return super().channel_call_join(channel_id, check_rtc_session_ids=check_rtc_session_ids)
-
-    @route("/mail/rtc/channel/leave_call", cors="*")
-    @add_guest_to_context
-    def channel_call_leave(self, channel_id):
-        return super().channel_call_leave(channel_id)
-
-    @route("/discuss/channel/ping", cors="*")
-    @add_guest_to_context
-    def channel_ping(self, channel_id, rtc_session_id=None, check_rtc_session_ids=None):
-        return super().channel_ping(channel_id, rtc_session_id=rtc_session_id, check_rtc_session_ids=check_rtc_session_ids)

addons/im_livechat/controllers/thread.py

@@ -1,16 +0,0 @@
-# Part of Odoo. See LICENSE file for full copyright and licensing details.
-
-from odoo.http import route
-from odoo.addons.mail.controllers.thread import ThreadController
-from odoo.addons.mail.models.discuss.mail_guest import add_guest_to_context
-
-class LivechatThreadController(ThreadController):
-    @route("/mail/message/post", cors="*")
-    @add_guest_to_context
-    def mail_message_post(self, thread_model, thread_id, post_data, context=None):
-        return super().mail_message_post(thread_model, thread_id, post_data, context)
-
-    @route("/mail/message/update_content", cors="*")
-    @add_guest_to_context
-    def mail_message_update_content(self, message_id, body, attachment_ids, attachment_tokens=None, partner_ids=None):
-        return super().mail_message_update_content(message_id, body, attachment_ids, attachment_tokens, partner_ids)

addons/im_livechat/controllers/webclient.py

@@ -11,8 +11,3 @@ class WebClient(WebclientController):
         return request.render("im_livechat.qunit_embed_suite", {
             "server_url": request.env["ir.config_parameter"].get_base_url(),
         })
-
-    @route("/mail/init_messaging", cors="*")
-    @add_guest_to_context
-    def mail_init_messaging(self):
-        return super().mail_init_messaging()

addons/im_livechat/static/src/embed/external/boot.js

@@ -35,11 +35,6 @@ import { session } from "@web/session";
                     if (!route.match(/^(?:https?:)?\/\//)) {
                         route = session.origin + route;
                     }
-                    const routeURL = new URL(route);
-                    const moduleName = routeURL.pathname.split("/").slice(1)[0];
-                    if (["discuss", "im_livechat", "mail"].includes(moduleName)) {
-                        params.guest_token = env.services["im_livechat.livechat"]?.guestToken;
-                    }
                     return jsonrpc(env, rpcId++, route, params, settings);
                 };
             },

addons/mail/models/discuss/mail_guest.py

@@ -24,16 +24,12 @@ def add_guest_to_context(func):
     @wraps(func)
     def wrapper(self, *args, **kwargs):
         req = request or wsrequest
-        guest = req.env["mail.guest"]._get_guest_from_context()
-        guest_token = kwargs.pop("guest_token", None)
-        if guest:
-            return func(self, *args, **kwargs)
         token = (
-            guest_token
-            or req.httprequest.cookies.get(req.env["mail.guest"]._cookie_name)
+            req.httprequest.cookies.get(req.env["mail.guest"]._cookie_name)
             or req.env.context.get("guest_token", "")
         )
         parts = token.split(req.env["mail.guest"]._cookie_separator)
+        guest = req.env["mail.guest"]
         if len(parts) == 2:
             guest_id, guest_access_token = parts
             guest = req.env["mail.guest"].browse(int(guest_id)).sudo().exists()
@@ -49,18 +45,6 @@ def add_guest_to_context(func):
             self.env.context = {**self.env.context, "guest": guest}
         return func(self, *args, **kwargs)
 
-    # Add the guest_token parameter to the wrapper signature
-    # so that it is not marked as being ignored. It will be
-    # popped before calling the wrapped function.
-    old_sig = signature(wrapper)
-    params = list(old_sig.parameters.values())
-    new_param_index = next((
-        index for index, param in enumerate(params)
-        if param.kind in [Parameter.VAR_POSITIONAL, Parameter.VAR_KEYWORD]
-    ), len(params))
-    new_param = Parameter("guest_token", Parameter.POSITIONAL_OR_KEYWORD, default=None)
-    params.insert(new_param_index, new_param)
-    wrapper.__signature__ = old_sig.replace(parameters=params)
     return wrapper