From 27405c0c83b05e9239eb76550004732776fc5e6a Mon Sep 17 00:00:00 2001 From: Fabien Meghazi Date: Tue, 11 Mar 2014 21:52:20 +0100 Subject: [PATCH 1/2] [FIX] ensure_db() werkzeug.BaseResponse.url usage leads to encoded hashes loss bzr revid: fme@openerp.com-20140311205220-kk0pal10lodurcst --- addons/web/controllers/main.py | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/addons/web/controllers/main.py b/addons/web/controllers/main.py index d13226ca731..0074a88ba9c 100644 --- a/addons/web/controllers/main.py +++ b/addons/web/controllers/main.py @@ -141,7 +141,12 @@ def ensure_db(redirect='/web/database/selector'): # Thus, we redirect the user to the same page but with the session cookie set. # This will force using the database route dispatcher... r = request.httprequest - response = werkzeug.utils.redirect(r.url, 302) + url_redirect = r.base_url + if r.query_string: + # Can't use werkzeug.wrappers.BaseRequest.url with encoded hashes: + # https://github.com/amigrave/werkzeug/commit/b4a62433f2f7678c234cdcac6247a869f90a7eb7 + url_redirect += '?' + r.query_string + response = werkzeug.utils.redirect(url_redirect, 302) request.session.db = db response = r.app.get_response(r, response, explicit_session=False) werkzeug.exceptions.abort(response) From cf68961f668b058952b205b5ba7991ea8c5f6b8b Mon Sep 17 00:00:00 2001 From: Fabien Meghazi Date: Wed, 12 Mar 2014 11:32:39 +0100 Subject: [PATCH 2/2] [IMP] /web/login redirects if already logged in bzr revid: fme@openerp.com-20140312103239-deyoc7t00g8kusd1 --- addons/web/controllers/main.py | 3 +++ 1 file changed, 3 insertions(+) diff --git a/addons/web/controllers/main.py b/addons/web/controllers/main.py index 0074a88ba9c..c30cd052bd6 100644 --- a/addons/web/controllers/main.py +++ b/addons/web/controllers/main.py @@ -663,6 +663,9 @@ class Home(http.Controller): def web_login(self, redirect=None, **kw): ensure_db() + if request.httprequest.method == 'GET' and redirect and request.session.uid: + return http.redirect_with_hash(redirect) + values = request.params.copy() if not redirect: redirect = '/web?' + request.httprequest.query_string