From 70006311d043198db25d6433c02a65364379fe16 Mon Sep 17 00:00:00 2001 From: Antoine Prieels Date: Tue, 27 Aug 2019 08:27:03 +0000 Subject: [PATCH 1/2] [IMP] hw_drivers, hw_posbox_homepage: get_ssid helper Create a helper to get the ssid of the wifi to which the Box is connected. --- addons/hw_drivers/drivers/PrinterDriver.py | 7 ++++--- addons/hw_drivers/tools/helpers.py | 5 +++++ addons/hw_posbox_homepage/controllers/main.py | 2 +- 3 files changed, 10 insertions(+), 4 deletions(-) diff --git a/addons/hw_drivers/drivers/PrinterDriver.py b/addons/hw_drivers/drivers/PrinterDriver.py index ec769de7599..68d023acb93 100644 --- a/addons/hw_drivers/drivers/PrinterDriver.py +++ b/addons/hw_drivers/drivers/PrinterDriver.py @@ -17,6 +17,7 @@ from PIL import Image, ImageOps from odoo import http, _ from odoo.addons.hw_drivers.controllers.driver import event_manager, Driver, PPDs, conn, printers, cups_lock, iot_devices +from odoo.addons.hw_drivers.tools import helpers from odoo.addons.hw_proxy.controllers.main import drivers as old_drivers _logger = logging.getLogger(__name__) @@ -245,14 +246,14 @@ class PrinterDriver(Driver): homepage = '' hosting_ap = os.system('pgrep hostapd') == 0 - ssid = subprocess.check_output('iwconfig 2>&1 | grep \'ESSID:"\' | sed \'s/.*"\\(.*\\)"/\\1/\'', shell=True).decode('utf-8').rstrip() + ssid = helpers.get_ssid() if hosting_ap: with open('/root_bypass_ramdisks/etc/hostapd/hostapd.conf') as config_file: lines = config_file.readlines() ssid = lines[1].split("=")[1].replace("\n", "") - wlan = 'Wireless network:\n%s\n\n' % ssid + wlan = '\nWireless network:\n%s\n\n' % ssid elif ssid: - wlan = 'Wireless network:\n%s\n\n' % ssid + wlan = '\nWireless network:\n%s\n\n' % ssid interfaces = ni.interfaces() ips = [] diff --git a/addons/hw_drivers/tools/helpers.py b/addons/hw_drivers/tools/helpers.py index a35aa0463de..9cc25440304 100644 --- a/addons/hw_drivers/tools/helpers.py +++ b/addons/hw_drivers/tools/helpers.py @@ -62,6 +62,11 @@ def get_mac_address(): except: return netifaces.ifaddresses('wlan0')[netifaces.AF_LINK][0]['addr'] +def get_ssid(): + process_iwconfig = subprocess.Popen(['iwconfig'], stdout=subprocess.PIPE, stderr=subprocess.STDOUT) + process_grep = subprocess.Popen(['grep', 'ESSID:"'], stdin=process_iwconfig.stdout, stdout=subprocess.PIPE) + return subprocess.check_output(['sed', 's/.*"\\(.*\\)"/\\1/'], stdin=process_grep.stdout).decode('utf-8').rstrip() + def get_odoo_server_url(): return read_file_first_line('odoo-remote-server.conf') diff --git a/addons/hw_posbox_homepage/controllers/main.py b/addons/hw_posbox_homepage/controllers/main.py index b1353e98cf1..2951857fc3e 100644 --- a/addons/hw_posbox_homepage/controllers/main.py +++ b/addons/hw_posbox_homepage/controllers/main.py @@ -63,7 +63,7 @@ class IoTboxHomepage(web.Home): hostname = str(socket.gethostname()) mac = get_mac() h = iter(hex(mac)[2:].zfill(12)) - ssid = subprocess.check_output('iwconfig 2>&1 | grep \'ESSID:"\' | sed \'s/.*"\\(.*\\)"/\\1/\'', shell=True).decode('utf-8').rstrip() + ssid = helpers.get_ssid() wired = subprocess.check_output('cat /sys/class/net/eth0/operstate', shell=True).decode('utf-8').strip('\n') if wired == 'up': network = 'Ethernet' From 6cf30cb8695a65d3663a5afb30bc41d32ca3a9b9 Mon Sep 17 00:00:00 2001 From: Antoine Prieels Date: Tue, 27 Aug 2019 08:28:38 +0000 Subject: [PATCH 2/2] [IMP] hw_*: Remove "Shell=True" in subrpocess calls In the IoT Box, most calls to subprocess used "Shell=True", which can cause security issues. TaskID: 1966417 --- addons/hw_posbox_homepage/controllers/main.py | 2 +- addons/hw_posbox_upgrade/controllers/main.py | 2 +- addons/hw_proxy/controllers/main.py | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/addons/hw_posbox_homepage/controllers/main.py b/addons/hw_posbox_homepage/controllers/main.py index 2951857fc3e..d5d6ebdbd95 100644 --- a/addons/hw_posbox_homepage/controllers/main.py +++ b/addons/hw_posbox_homepage/controllers/main.py @@ -64,7 +64,7 @@ class IoTboxHomepage(web.Home): mac = get_mac() h = iter(hex(mac)[2:].zfill(12)) ssid = helpers.get_ssid() - wired = subprocess.check_output('cat /sys/class/net/eth0/operstate', shell=True).decode('utf-8').strip('\n') + wired = subprocess.check_output(['cat', '/sys/class/net/eth0/operstate']).decode('utf-8').strip('\n') if wired == 'up': network = 'Ethernet' elif ssid: diff --git a/addons/hw_posbox_upgrade/controllers/main.py b/addons/hw_posbox_upgrade/controllers/main.py index a376f4eee22..8c3b1331ec6 100644 --- a/addons/hw_posbox_upgrade/controllers/main.py +++ b/addons/hw_posbox_upgrade/controllers/main.py @@ -34,7 +34,7 @@ class PosboxUpgrader(hw_proxy.Proxy): @http.route('/hw_proxy/upgrade', type='http', auth='none', ) def upgrade(self): - commit = subprocess.check_output("git --work-tree=/home/pi/odoo/ --git-dir=/home/pi/odoo/.git log -1", shell=True).decode('utf-8').replace("\n", "
") + commit = subprocess.check_output(["git", "--work-tree=/home/pi/odoo/", "--git-dir=/home/pi/odoo/.git", "log", "-1"]).decode('utf-8').replace("\n", "
") return upgrade_page_template.render({ 'title': "Odoo's IoTBox - Software Upgrade", 'breadcrumb': 'IoT Box Software Upgrade', diff --git a/addons/hw_proxy/controllers/main.py b/addons/hw_proxy/controllers/main.py index f67babef3d0..797644a395d 100644 --- a/addons/hw_proxy/controllers/main.py +++ b/addons/hw_proxy/controllers/main.py @@ -127,7 +127,7 @@ class Proxy(http.Controller): %s - """ % subprocess.check_output('lsusb -v', shell=True).decode('utf-8') + """ % subprocess.check_output(['lsusb', '-v']).decode('utf-8') return request.make_response(resp,{ 'Cache-Control': 'no-cache',