From 4fb4964fc3a142d58d36ba330eba0cfa9da636e9 Mon Sep 17 00:00:00 2001 From: Olivier Dony Date: Mon, 31 Oct 2022 15:10:22 +0000 Subject: [PATCH] [FIX] web, website: /web/login should simulate auth=public The /web/login route is historically defined to be auth=none, which means that it is available even when no database is selected (yet), and no db_filter is set to automatically select one. This is done mainly to be able to redirect users to the database selection screen (cfr ensure_db()) instead of showing them a 404 until they manually go to the /web/database/selector page. The conversion of this mechanism in odoo/odoo#87571 can cause problems because the user environment used to render the login page uses the superuser ID. In certain configurations of installed modules, it was possible to have the /web/login page showing "OdooBot" as the logged in user, despite no user being actually logged in at all. To fix this, we override the env that was set by auth=none: - with the current session user, if there is one (like `/web` does) - with the public user otherwise (as auth=public would do) closes odoo/odoo#107613 X-original-commit: 6e42a07d7637070d45be81dcbf7261eda08425b4 Signed-off-by: Julien Castiaux --- addons/web/controllers/home.py | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/addons/web/controllers/home.py b/addons/web/controllers/home.py index 7b46be35d32..2483da10e02 100644 --- a/addons/web/controllers/home.py +++ b/addons/web/controllers/home.py @@ -88,9 +88,15 @@ class Home(http.Controller): if request.httprequest.method == 'GET' and redirect and request.session.uid: return request.redirect(redirect) - # so it is correct if overloaded with auth="public" - if not request.uid: - request.update_env(user=odoo.SUPERUSER_ID) + # simulate hybrid auth=user/auth=public, despite using auth=none to be able + # to redirect users when no db is selected - cfr ensure_db() + if request.env.uid is None: + if request.session.uid is None: + # no user -> auth=public with specific website public user + request.env["ir.http"]._auth_method_public() + else: + # auth=user + request.update_env(user=request.session.uid) values = {k: v for k, v in request.params.items() if k in SIGN_UP_REQUEST_PARAMS} try: