pengyuthon/odoo_source
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[IMP] base, web: unify the behavior of cookie setters

Browse Source 
Both implementations of `set_cookie` in `http.py` and the one of
`setCookie` in `cookie_utils.js` are slightly different.

This commit unifies both Python implementations and replicates the same
behavior in JS:
- default the cookie type to "required"
- if setting that type is not allowed, delete that cookie if it was
previously set

task-2800976

closes odoo/odoo#102380

X-original-commit: fa8fdab2894607f1f89cdd195f62ec37af7b0342
Signed-off-by: Romain Derie (rde) <rde@odoo.com>
This commit is contained in:
Benoit Socias
2022-10-06 17:00:33 +02:00
parent 329b0522a7
commit 720a8c9940
2 changed files with 17 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files
addons/web/static/src/legacy/js/core/cookie_utils.js
+7 -9
View File
@@ -39,15 +39,13 @@ const utils = {
* @param {string} type the type of the cookies ('required' as default value)
*/
setCookie(name, value, ttl = 31536000, type = 'required') {
ttl = ttl || 24 * 60 * 60 * 365;
if (utils.isAllowedCookie(type)) {
document.cookie = [
`${name}=${value}`,
'path=/',
`max-age=${ttl}`,
`expires=${new Date(new Date().getTime() + ttl * 1000).toGMTString()}`,
].join(';');
}
ttl = utils.isAllowedCookie(type) ? ttl || 24 * 60 * 60 * 365 : -1;
document.cookie = [
`${name}=${value}`,
'path=/',
`max-age=${ttl}`,
`expires=${new Date(new Date().getTime() + ttl * 1000).toGMTString()}`,
].join(';');
},
/**
* Deletes a cookie.
odoo/http.py
+10 -14
View File
@@ -1059,13 +1059,11 @@ class Response(werkzeug.wrappers.Response):
self.response.append(self.render())
self.template = None
def set_cookie(self, *args, **kwargs):
cookie_type = kwargs.pop('cookie_type', None)
if request.db:
if not request.env['ir.http']._is_allowed_cookie(cookie_type):
kwargs['expires'] = 0
kwargs['max_age'] = 0
super().set_cookie(*args, **kwargs)
def set_cookie(self, key, value='', max_age=None, expires=None, path='/', domain=None, secure=False, httponly=False, samesite=None, cookie_type='required'):
if request.db and not request.env['ir.http']._is_allowed_cookie(cookie_type):
expires = 0
max_age = 0
super().set_cookie(key, value=value, max_age=max_age, expires=expires, path=path, domain=domain, secure=secure, httponly=httponly, samesite=samesite)
class FutureResponse:
@@ -1081,13 +1079,11 @@ class FutureResponse:
self.headers = werkzeug.datastructures.Headers()
@functools.wraps(werkzeug.Response.set_cookie)
def set_cookie(self, *args, **kwargs):
if 'cookie_type' in kwargs and request.db:
cookie_type = kwargs.pop('cookie_type', 'required')
if not request.env['ir.http']._is_allowed_cookie(cookie_type):
kwargs['expires'] = 0
kwargs['max_age'] = 0
werkzeug.Response.set_cookie(self, *args, **kwargs)
def set_cookie(self, key, value='', max_age=None, expires=None, path='/', domain=None, secure=False, httponly=False, samesite=None, cookie_type='required'):
if request.db and not request.env['ir.http']._is_allowed_cookie(cookie_type):
expires = 0
max_age = 0
werkzeug.Response.set_cookie(self, key, value=value, max_age=max_age, expires=expires, path=path, domain=domain, secure=secure, httponly=httponly, samesite=samesite)
class Request: