From d99835ee9c5adcce99abe41363316b63cfb29404 Mon Sep 17 00:00:00 2001 From: Martin Trigaux Date: Tue, 16 Sep 2014 15:27:56 +0200 Subject: [PATCH 1/3] [FIX] payment: access rights limitation Do not allow everybody to access account.transactions. Restrict by default to readonly and even restrict the access with a record rule, give access to salesman. --- addons/payment/__openerp__.py | 1 + addons/payment/security/ir.model.access.csv | 2 +- addons/payment/security/payment_security.xml | 24 ++++++++++++++++++++ addons/payment_paypal/models/paypal.py | 3 ++- addons/website_payment/__openerp__.py | 1 + addons/website_payment/payment_security.xml | 10 ++++++++ 6 files changed, 39 insertions(+), 2 deletions(-) create mode 100644 addons/payment/security/payment_security.xml create mode 100644 addons/website_payment/payment_security.xml diff --git a/addons/payment/__openerp__.py b/addons/payment/__openerp__.py index c192bec7c1b..a3843a872c1 100644 --- a/addons/payment/__openerp__.py +++ b/addons/payment/__openerp__.py @@ -12,6 +12,7 @@ 'views/payment_acquirer.xml', 'views/res_config_view.xml', 'security/ir.model.access.csv', + 'security/payment_security.xml', ], 'installable': True, 'auto_install': True, diff --git a/addons/payment/security/ir.model.access.csv b/addons/payment/security/ir.model.access.csv index 18f98939472..f52f9a44d4e 100644 --- a/addons/payment/security/ir.model.access.csv +++ b/addons/payment/security/ir.model.access.csv @@ -2,6 +2,6 @@ id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink payment_acquirer_all,payment.acquirer.all,model_payment_acquirer,,1,0,0,0 payment_acquirer_user,payment.acquirer.user,model_payment_acquirer,base.group_user,1,1,1,0 payment_acquirer_system,payment.acquirer.system,model_payment_acquirer,base.group_system,1,1,1,1 -payment_transaction_all,payment.transaction.all,model_payment_transaction,,1,1,1,0 +payment_transaction_all,payment.transaction.all,model_payment_transaction,,1,0,0,0 payment_transaction_user,payment.transaction.user,model_payment_transaction,base.group_user,1,1,1,0 payment_transaction_system,payment.transaction.system,model_payment_transaction,base.group_system,1,1,1,1 \ No newline at end of file diff --git a/addons/payment/security/payment_security.xml b/addons/payment/security/payment_security.xml new file mode 100644 index 00000000000..8fb4def2811 --- /dev/null +++ b/addons/payment/security/payment_security.xml @@ -0,0 +1,24 @@ + + + + + + Access own payment transaction only + + [ + '|', + ('partner_id','=',False), + ('partner_id','=',user.partner_id.id) + ] + + + + + Access every payment transaction + + [(1, '=', 1)] + + + + + diff --git a/addons/payment_paypal/models/paypal.py b/addons/payment_paypal/models/paypal.py index a17f6ac83b5..bade2343fa9 100644 --- a/addons/payment_paypal/models/paypal.py +++ b/addons/payment_paypal/models/paypal.py @@ -14,6 +14,7 @@ from openerp.addons.payment.models.payment_acquirer import ValidationError from openerp.addons.payment_paypal.controllers.main import PaypalController from openerp.osv import osv, fields from openerp.tools.float_utils import float_compare +from openerp import SUPERUSER_ID _logger = logging.getLogger(__name__) @@ -99,7 +100,7 @@ class AcquirerPaypal(osv.Model): return fees def paypal_form_generate_values(self, cr, uid, id, partner_values, tx_values, context=None): - base_url = self.pool['ir.config_parameter'].get_param(cr, uid, 'web.base.url') + base_url = self.pool['ir.config_parameter'].get_param(cr, SUPERUSER_ID, 'web.base.url') acquirer = self.browse(cr, uid, id, context=context) paypal_tx_values = dict(tx_values) diff --git a/addons/website_payment/__openerp__.py b/addons/website_payment/__openerp__.py index c745f643fec..4c13b562b5e 100644 --- a/addons/website_payment/__openerp__.py +++ b/addons/website_payment/__openerp__.py @@ -12,6 +12,7 @@ 'payment', ], 'data': [ + 'payment_security.xml', 'views/website_payment_templates.xml', 'views/website_settings_payment.xml', ], diff --git a/addons/website_payment/payment_security.xml b/addons/website_payment/payment_security.xml new file mode 100644 index 00000000000..d8aafa15631 --- /dev/null +++ b/addons/website_payment/payment_security.xml @@ -0,0 +1,10 @@ + + + + + + + + + + From 28a27a9f91522ca9cb5387f98e56b1cc300a8dd0 Mon Sep 17 00:00:00 2001 From: Martin Trigaux Date: Wed, 17 Sep 2014 11:05:32 +0200 Subject: [PATCH 2/3] [IMP] payment: simplify rev d99835e The group public is defined in base so no need to add security rule in website_payment module (same as for portal) --- addons/payment/security/payment_security.xml | 2 +- addons/website_payment/__openerp__.py | 1 - addons/website_payment/payment_security.xml | 10 ---------- 3 files changed, 1 insertion(+), 12 deletions(-) delete mode 100644 addons/website_payment/payment_security.xml diff --git a/addons/payment/security/payment_security.xml b/addons/payment/security/payment_security.xml index 8fb4def2811..7bae346c648 100644 --- a/addons/payment/security/payment_security.xml +++ b/addons/payment/security/payment_security.xml @@ -10,7 +10,7 @@ ('partner_id','=',False), ('partner_id','=',user.partner_id.id) ] - + diff --git a/addons/website_payment/__openerp__.py b/addons/website_payment/__openerp__.py index 4c13b562b5e..c745f643fec 100644 --- a/addons/website_payment/__openerp__.py +++ b/addons/website_payment/__openerp__.py @@ -12,7 +12,6 @@ 'payment', ], 'data': [ - 'payment_security.xml', 'views/website_payment_templates.xml', 'views/website_settings_payment.xml', ], diff --git a/addons/website_payment/payment_security.xml b/addons/website_payment/payment_security.xml deleted file mode 100644 index d8aafa15631..00000000000 --- a/addons/website_payment/payment_security.xml +++ /dev/null @@ -1,10 +0,0 @@ - - - - - - - - - - From 2ee1843757e87a75a36dce29eb47f784a4725c34 Mon Sep 17 00:00:00 2001 From: Martin Trigaux Date: Wed, 17 Sep 2014 12:28:21 +0200 Subject: [PATCH 3/3] [FIX] website_sale: retrieve transactions as superuser Due to additional security rules, the transactions made as public user will have a new partner_id. The transaction needs to be retrieved as admin to be set in the context. The operations in payment_get_status are made as superuser but the session_id is checked in the assert above to avoid url manipulation. --- addons/website_sale/controllers/main.py | 4 ++-- addons/website_sale/models/website.py | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/addons/website_sale/controllers/main.py b/addons/website_sale/controllers/main.py index 083f9651fd1..0e193243cc1 100644 --- a/addons/website_sale/controllers/main.py +++ b/addons/website_sale/controllers/main.py @@ -690,7 +690,7 @@ class Ecommerce(http.Controller): } tx_ids = request.registry['payment.transaction'].search( - cr, uid, [ + cr, SUPERUSER_ID, [ '|', ('sale_order_id', '=', order.id), ('reference', '=', order.name) ], context=context) @@ -705,7 +705,7 @@ class Ecommerce(http.Controller): message = "" validation = None else: - tx = request.registry['payment.transaction'].browse(cr, uid, tx_ids[0], context=context) + tx = request.registry['payment.transaction'].browse(cr, SUPERUSER_ID, tx_ids[0], context=context) state = tx.state if state == 'done': message = '

%s

' % _('Your payment has been received.') diff --git a/addons/website_sale/models/website.py b/addons/website_sale/models/website.py index d969d2a9211..2c5de4f9b49 100644 --- a/addons/website_sale/models/website.py +++ b/addons/website_sale/models/website.py @@ -214,7 +214,7 @@ class Website(orm.Model): def preprocess_request(self, cr, uid, ids, request, context=None): request.context.update({ 'website_sale_order': self.ecommerce_get_current_order(cr, uid, context=context), - 'website_sale_transaction': self.ecommerce_get_current_transaction(cr, uid, context=context) + 'website_sale_transaction': self.ecommerce_get_current_transaction(cr, SUPERUSER_ID, context=context) }) return super(Website, self).preprocess_request(cr, uid, ids, request, context=None)