From 0c84c4f36dbe083010a3541a04bf920d4be84e67 Mon Sep 17 00:00:00 2001 From: tsm-odoo Date: Wed, 13 Sep 2023 16:47:20 +0200 Subject: [PATCH] [REV] im_livechat, mail: remove cors from discuss route overrides MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR removes the livechat's discuss route overrides that added `cors="*"` since they are not safe (different databases on our cloud are considered as SameSite). In the meantime, embed livechats won't work as expected since cors is prevented and will be fixed in a following PR. closes odoo/odoo#135260 Signed-off-by: Sébastien Theys (seb) --- addons/im_livechat/controllers/__init__.py | 5 --- addons/im_livechat/controllers/channel.py | 12 ------- .../im_livechat/controllers/link_preview.py | 17 ---------- .../controllers/message_reaction.py | 12 ------- addons/im_livechat/controllers/rtc.py | 32 ------------------- addons/im_livechat/controllers/thread.py | 16 ---------- addons/im_livechat/controllers/webclient.py | 5 --- .../static/src/embed/external/boot.js | 5 --- addons/mail/models/discuss/mail_guest.py | 20 ++---------- 9 files changed, 2 insertions(+), 122 deletions(-) delete mode 100644 addons/im_livechat/controllers/channel.py delete mode 100644 addons/im_livechat/controllers/link_preview.py delete mode 100644 addons/im_livechat/controllers/message_reaction.py delete mode 100644 addons/im_livechat/controllers/rtc.py delete mode 100644 addons/im_livechat/controllers/thread.py diff --git a/addons/im_livechat/controllers/__init__.py b/addons/im_livechat/controllers/__init__.py index a07d2115090..1e383b124d7 100644 --- a/addons/im_livechat/controllers/__init__.py +++ b/addons/im_livechat/controllers/__init__.py @@ -1,11 +1,6 @@ # -*- coding: utf-8 -*- # Part of Odoo. See LICENSE file for full copyright and licensing details. -from . import channel from . import chatbot -from . import link_preview from . import main -from . import message_reaction -from . import rtc -from . import thread from . import webclient diff --git a/addons/im_livechat/controllers/channel.py b/addons/im_livechat/controllers/channel.py deleted file mode 100644 index 89422f69395..00000000000 --- a/addons/im_livechat/controllers/channel.py +++ /dev/null @@ -1,12 +0,0 @@ -# Part of Odoo. See LICENSE file for full copyright and licensing details. - -from odoo.http import route -from odoo.addons.mail.controllers.discuss.channel import ChannelController -from odoo.addons.mail.models.discuss.mail_guest import add_guest_to_context - - -class LivechatChannelController(ChannelController): - @route("/discuss/channel/messages", cors="*") - @add_guest_to_context - def discuss_channel_messages(self, channel_id, before=None, after=None, limit=30, around=None): - return super().discuss_channel_messages(channel_id, before, after, limit, around) diff --git a/addons/im_livechat/controllers/link_preview.py b/addons/im_livechat/controllers/link_preview.py deleted file mode 100644 index d5049229237..00000000000 --- a/addons/im_livechat/controllers/link_preview.py +++ /dev/null @@ -1,17 +0,0 @@ -# Part of Odoo. See LICENSE file for full copyright and licensing details. - -from odoo.http import route -from odoo.addons.mail.controllers.link_preview import LinkPreviewController -from odoo.addons.mail.models.discuss.mail_guest import add_guest_to_context - - -class LivechatLinkPreviewController(LinkPreviewController): - @route("/mail/link_preview", cors="*") - @add_guest_to_context - def mail_link_preview(self, message_id, clear=None): - return super().mail_link_preview(message_id, clear) - - @route("/mail/link_preview/delete", cors="*") - @add_guest_to_context - def mail_link_preview_delete(self, link_preview_id): - return super().mail_link_preview_delete(link_preview_id) diff --git a/addons/im_livechat/controllers/message_reaction.py b/addons/im_livechat/controllers/message_reaction.py deleted file mode 100644 index bb9c64d82f1..00000000000 --- a/addons/im_livechat/controllers/message_reaction.py +++ /dev/null @@ -1,12 +0,0 @@ -# Part of Odoo. See LICENSE file for full copyright and licensing details. - -from odoo.http import route -from odoo.addons.mail.controllers.message_reaction import MessageReactionController -from odoo.addons.mail.models.discuss.mail_guest import add_guest_to_context - - -class LivechatReactionController(MessageReactionController): - @route("/mail/message/reaction", cors="*") - @add_guest_to_context - def mail_message_add_reaction(self, message_id, content, action): - return super().mail_message_add_reaction(message_id, content, action) diff --git a/addons/im_livechat/controllers/rtc.py b/addons/im_livechat/controllers/rtc.py deleted file mode 100644 index 433be032800..00000000000 --- a/addons/im_livechat/controllers/rtc.py +++ /dev/null @@ -1,32 +0,0 @@ -# Part of Odoo. See LICENSE file for full copyright and licensing details. - -from odoo.http import route -from odoo.addons.mail.models.discuss.mail_guest import add_guest_to_context -from odoo.addons.mail.controllers.discuss.rtc import RtcController - - -class LivechatRtcController(RtcController): - @route("/mail/rtc/session/notify_call_members", cors="*") - @add_guest_to_context - def session_call_notify(self, peer_notifications): - return super().session_call_notify(peer_notifications) - - @route("/mail/rtc/session/update_and_broadcast", cors="*") - @add_guest_to_context - def session_update_and_broadcast(self, session_id, values): - return super().session_update_and_broadcast(session_id, values) - - @route("/mail/rtc/channel/join_call", cors="*") - @add_guest_to_context - def channel_call_join(self, channel_id, check_rtc_session_ids=None): - return super().channel_call_join(channel_id, check_rtc_session_ids=check_rtc_session_ids) - - @route("/mail/rtc/channel/leave_call", cors="*") - @add_guest_to_context - def channel_call_leave(self, channel_id): - return super().channel_call_leave(channel_id) - - @route("/discuss/channel/ping", cors="*") - @add_guest_to_context - def channel_ping(self, channel_id, rtc_session_id=None, check_rtc_session_ids=None): - return super().channel_ping(channel_id, rtc_session_id=rtc_session_id, check_rtc_session_ids=check_rtc_session_ids) diff --git a/addons/im_livechat/controllers/thread.py b/addons/im_livechat/controllers/thread.py deleted file mode 100644 index b1adfb3d77f..00000000000 --- a/addons/im_livechat/controllers/thread.py +++ /dev/null @@ -1,16 +0,0 @@ -# Part of Odoo. See LICENSE file for full copyright and licensing details. - -from odoo.http import route -from odoo.addons.mail.controllers.thread import ThreadController -from odoo.addons.mail.models.discuss.mail_guest import add_guest_to_context - -class LivechatThreadController(ThreadController): - @route("/mail/message/post", cors="*") - @add_guest_to_context - def mail_message_post(self, thread_model, thread_id, post_data, context=None): - return super().mail_message_post(thread_model, thread_id, post_data, context) - - @route("/mail/message/update_content", cors="*") - @add_guest_to_context - def mail_message_update_content(self, message_id, body, attachment_ids, attachment_tokens=None, partner_ids=None): - return super().mail_message_update_content(message_id, body, attachment_ids, attachment_tokens, partner_ids) diff --git a/addons/im_livechat/controllers/webclient.py b/addons/im_livechat/controllers/webclient.py index fbda28fca77..4f1303baf2c 100644 --- a/addons/im_livechat/controllers/webclient.py +++ b/addons/im_livechat/controllers/webclient.py @@ -11,8 +11,3 @@ class WebClient(WebclientController): return request.render("im_livechat.qunit_embed_suite", { "server_url": request.env["ir.config_parameter"].get_base_url(), }) - - @route("/mail/init_messaging", cors="*") - @add_guest_to_context - def mail_init_messaging(self): - return super().mail_init_messaging() diff --git a/addons/im_livechat/static/src/embed/external/boot.js b/addons/im_livechat/static/src/embed/external/boot.js index f6f062b62d1..027ed02bd88 100644 --- a/addons/im_livechat/static/src/embed/external/boot.js +++ b/addons/im_livechat/static/src/embed/external/boot.js @@ -35,11 +35,6 @@ import { session } from "@web/session"; if (!route.match(/^(?:https?:)?\/\//)) { route = session.origin + route; } - const routeURL = new URL(route); - const moduleName = routeURL.pathname.split("/").slice(1)[0]; - if (["discuss", "im_livechat", "mail"].includes(moduleName)) { - params.guest_token = env.services["im_livechat.livechat"]?.guestToken; - } return jsonrpc(env, rpcId++, route, params, settings); }; }, diff --git a/addons/mail/models/discuss/mail_guest.py b/addons/mail/models/discuss/mail_guest.py index 0de1a420674..8afdf21c207 100644 --- a/addons/mail/models/discuss/mail_guest.py +++ b/addons/mail/models/discuss/mail_guest.py @@ -24,16 +24,12 @@ def add_guest_to_context(func): @wraps(func) def wrapper(self, *args, **kwargs): req = request or wsrequest - guest = req.env["mail.guest"]._get_guest_from_context() - guest_token = kwargs.pop("guest_token", None) - if guest: - return func(self, *args, **kwargs) token = ( - guest_token - or req.httprequest.cookies.get(req.env["mail.guest"]._cookie_name) + req.httprequest.cookies.get(req.env["mail.guest"]._cookie_name) or req.env.context.get("guest_token", "") ) parts = token.split(req.env["mail.guest"]._cookie_separator) + guest = req.env["mail.guest"] if len(parts) == 2: guest_id, guest_access_token = parts guest = req.env["mail.guest"].browse(int(guest_id)).sudo().exists() @@ -49,18 +45,6 @@ def add_guest_to_context(func): self.env.context = {**self.env.context, "guest": guest} return func(self, *args, **kwargs) - # Add the guest_token parameter to the wrapper signature - # so that it is not marked as being ignored. It will be - # popped before calling the wrapped function. - old_sig = signature(wrapper) - params = list(old_sig.parameters.values()) - new_param_index = next(( - index for index, param in enumerate(params) - if param.kind in [Parameter.VAR_POSITIONAL, Parameter.VAR_KEYWORD] - ), len(params)) - new_param = Parameter("guest_token", Parameter.POSITIONAL_OR_KEYWORD, default=None) - params.insert(new_param_index, new_param) - wrapper.__signature__ = old_sig.replace(parameters=params) return wrapper