From 75fa30fc546e4a88193c7159f7694e38eedf89c2 Mon Sep 17 00:00:00 2001 From: Antony Lesuisse Date: Wed, 28 Jan 2015 00:32:51 +0100 Subject: [PATCH] [FIX] base: ir_config_parameter increase database.uuid.private entropy Use uuid4 instead of uuid1 to get 128 bits of entropy. Rename database.uuid.private to the more meaningful database.secret as it explains the usage instead of the technical details to generate it. And we might switch to a longer string with more entropy in the future. This string can be used to sign cookies or token with sign(src) -> (src, hash(src + secret)) check(msg) -> msg[1] == hash(msg[0] + secret) --- addons/website_crm_score/models/crm_lead.py | 2 +- openerp/addons/base/ir/ir_config_parameter.py | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/addons/website_crm_score/models/crm_lead.py b/addons/website_crm_score/models/crm_lead.py index 7eea71806c9..47e84cb8248 100644 --- a/addons/website_crm_score/models/crm_lead.py +++ b/addons/website_crm_score/models/crm_lead.py @@ -51,7 +51,7 @@ class Lead(models.Model): return None def get_key(self): - return self.pool['ir.config_parameter'].get_param(request.cr, SUPERUSER_ID, 'database.uuid.private') + return self.pool['ir.config_parameter'].get_param(request.cr, SUPERUSER_ID, 'database.secret') def get_score_domain_cookies(self): return request.httprequest.host diff --git a/openerp/addons/base/ir/ir_config_parameter.py b/openerp/addons/base/ir/ir_config_parameter.py index 560e9727c99..95c1d0348e8 100644 --- a/openerp/addons/base/ir/ir_config_parameter.py +++ b/openerp/addons/base/ir/ir_config_parameter.py @@ -33,7 +33,7 @@ from openerp.tools import misc, config A dictionary holding some configuration parameters to be initialized when the database is created. """ _default_parameters = { - "database.uuid.private": lambda: (str(uuid.uuid1()), ['base.group_erp_manager']), + "database.secret": lambda: (str(uuid.uuid1()), ['base.group_erp_manager']), "database.uuid": lambda: (str(uuid.uuid1()), []), "database.create_date": lambda: (datetime.datetime.now().strftime(misc.DEFAULT_SERVER_DATETIME_FORMAT), ['base.group_user']), "web.base.url": lambda: ("http://localhost:%s" % config.get('xmlrpc_port'), []),