From 896e40fa62b276e6ad04c79cea8f4d0702ec1ff1 Mon Sep 17 00:00:00 2001 From: Adrien Widart Date: Tue, 2 Nov 2021 08:47:26 +0000 Subject: [PATCH] [FIX] web: report action: define trusted_host thanks to current URL To reproduce the issue: (Need stock. Use demo data) 1. Login as admin 2. Go again on the DB, but using another URL 3. Login as demo 4. Consult the Forecasted Report of [FURN_7800] Desk Combination 5. Try to open "WH/OUT/00009" Error: Nothing happens although the page should be redirected to the order. In the browser console, an error message is displayed: "Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('http://localhost:8069') does not match the recipient window's origin ('http://yourcompany.com:8069')." When logging in as admin, the config parameter `web.base.url` is defined with the URL used (URL01): https://github.com/odoo/odoo/blob/4736344a57e176ed38f4b22cd100b3957d122818/odoo/addons/base/models/res_users.py#L717-L724 Then, when logging in as demo with another URL (URL02), since he's not an administrator, the config parameter is not overwritten. So, when clicking on the delivery order (step 5), an action is executed: https://github.com/odoo/odoo/blob/b492bde6a121be1c15ed90ce0827fcfd72a12f5c/addons/web/static/src/js/report/report.js#L37-L41 where `trusted_origin` is based on `web.base.url`: https://github.com/odoo/odoo/blob/2dbe39aed5361341cdc87607e671ef19234e0196/odoo/addons/base/models/ir_actions_report.py#L580 This explains why `trusted_origin` is URL01 and thus why the error is raised. Also, suppose `trusted_origin` has a correct value (URL02), there is another issue: when the client action receives the message, a condition will ensure that the message origin and the origin of the action are the same: https://github.com/odoo/odoo/blob/d3854dbf7a6e0c0f9ac00c11716908bc175808d7/addons/web/static/src/js/report/client_action.js#L73-L76 Here, `this.trusted_origin` is also URL01 because of https://github.com/odoo/odoo/blob/62f2a62b7265645dee91c276c5171b402c0a44fa/addons/web/models/ir_http.py#L48 So this variable definition needs to be updated too. OPW-2615024 closes odoo/odoo#80777 X-original-commit: f8ac33bcbc472d55917a1597afdd444f815d4778 Signed-off-by: Lucas Perais (lpe) Signed-off-by: Adrien Widart --- addons/web/static/src/legacy/js/report/client_action.js | 2 +- addons/web/static/src/legacy/js/report/report.js | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/addons/web/static/src/legacy/js/report/client_action.js b/addons/web/static/src/legacy/js/report/client_action.js index d4cb3096aea..116b96e9181 100644 --- a/addons/web/static/src/legacy/js/report/client_action.js +++ b/addons/web/static/src/legacy/js/report/client_action.js @@ -43,7 +43,7 @@ var ReportAction = AbstractAction.extend({ $buttons: this.$buttons, }; return Promise.all([this._super.apply(this, arguments), session.is_bound]).then(async function () { - var web_base_url = session['web.base.url']; + var web_base_url = window.origin; var trusted_host = utils.get_host_from_url(web_base_url); var trusted_protocol = utils.get_protocol_from_url(web_base_url); self.trusted_origin = utils.build_origin(trusted_protocol, trusted_host); diff --git a/addons/web/static/src/legacy/js/report/report.js b/addons/web/static/src/legacy/js/report/report.js index daf50c0ef46..ae580c8d488 100644 --- a/addons/web/static/src/legacy/js/report/report.js +++ b/addons/web/static/src/legacy/js/report/report.js @@ -13,7 +13,7 @@ $(document.body) .addClass('container-fluid') .removeClass('container'); -var web_base_url = $('html').attr('web-base-url'); +var web_base_url = window.origin; var trusted_host = utils.get_host_from_url(web_base_url); var trusted_protocol = utils.get_protocol_from_url(web_base_url); var trusted_origin = utils.build_origin(trusted_protocol, trusted_host);