From 768db8390d18c92e55837f211a368c6860cfa0ae Mon Sep 17 00:00:00 2001 From: Benoit Socias Date: Wed, 23 Mar 2022 10:13:36 +0000 Subject: [PATCH] [FIX] website, website_payment: exclude Donation snippet from cache Since [1] the CSRF token used by the donation snippet's form did end up being cached for new visitors that did not have a session id yet. This made the validation of the token fail when using the form because the token from the very first new visitor on the worker was reused. After this commit pages that contain a Donation snippet are not cached anymore in order to always get a fresh CSRF token - similarly to what is done for the form snippet. When using incognito mode the csrf token is sometimes not recognized during navigation to the donation payment page. Simple sequence to reproduce it: - drop a Donation snippet on the Home page - use Firefox and do not log in - in normal browser, select 25 then press Donate Now - open an incognito browser, select 50 then press Donate Now => 400 Bad Request Alternative (any browser): - open page with Donation snippet in incognito window - remove session id from cookies using developer tools - close window - reopen page in a new incognito window - try to donate => 400 Bad Request [1]: https://github.com/odoo/odoo/commit/7fccbac004628093da49016f75370a84bba49465 opw-2774065 closes odoo/odoo#88184 X-original-commit: 16c9b103195f342f8bcca928a53121dbe4480d58 Signed-off-by: Romain Derie (rde) --- addons/website/models/website_page.py | 4 ++-- addons/website_payment/models/__init__.py | 1 + addons/website_payment/models/website_page.py | 15 +++++++++++++++ 3 files changed, 18 insertions(+), 2 deletions(-) create mode 100644 addons/website_payment/models/website_page.py diff --git a/addons/website/models/website_page.py b/addons/website/models/website_page.py index 797696a210a..c05d111042e 100644 --- a/addons/website/models/website_page.py +++ b/addons/website/models/website_page.py @@ -221,8 +221,8 @@ class Page(models.Model): self.ensure_one() return self.view_id.get_website_meta() - @staticmethod - def _get_cached_blacklist(): + @api.model + def _get_cached_blacklist(self): return ('data-snippet="s_website_form"', 'data-no-page-cache=', ) def _can_be_cached(self, response): diff --git a/addons/website_payment/models/__init__.py b/addons/website_payment/models/__init__.py index 8d2fcd92b39..08188c1ec48 100644 --- a/addons/website_payment/models/__init__.py +++ b/addons/website_payment/models/__init__.py @@ -5,3 +5,4 @@ from . import account_payment from . import payment_acquirer from . import payment_transaction from . import res_config_settings +from . import website_page diff --git a/addons/website_payment/models/website_page.py b/addons/website_payment/models/website_page.py new file mode 100644 index 00000000000..7c12eccb806 --- /dev/null +++ b/addons/website_payment/models/website_page.py @@ -0,0 +1,15 @@ +# -*- coding: utf-8 -*- +# Part of Odoo. See LICENSE file for full copyright and licensing details. + +from odoo import api, models + + +class Page(models.Model): + _inherit = 'website.page' + + @api.model + def _get_cached_blacklist(self): + return super()._get_cached_blacklist() + ( + # Contains a form with a dynamically added CSRF token + 'data-snippet="s_donation"', + )