From 9a456ac078ea59ae10fa68ecb65ed1eb2736758f Mon Sep 17 00:00:00 2001
From: Christophe Simonis <chs@openerp.com>
Date: Fri, 13 Dec 2013 16:52:12 +0100
Subject: [PATCH] [FIX] ir.module.module: install_from_urls is restricted to
 administrators and only accept urls from apps server [FIX] ir.module.module:
 download() method is now a no-op. This method was in fact already a no-op as
 the "url" field is never set explicitly in the code.

lp bug: https://launchpad.net/bugs/1260747 fixed

bzr revid: chs@openerp.com-20131213155212-9m1pnbpz97upyz3i
---
 openerp/addons/base/module/module.py      | 49 +++++++----------------
 openerp/addons/base/static/src/js/apps.js |  4 +-
 2 files changed, 17 insertions(+), 36 deletions(-)

diff --git a/openerp/addons/base/module/module.py b/openerp/addons/base/module/module.py
index 5dcb1693c67..6b2ef46f68d 100644
--- a/openerp/addons/base/module/module.py
+++ b/openerp/addons/base/module/module.py
@@ -30,6 +30,7 @@ import shutil
 import tempfile
 import urllib
 import urllib2
+import urlparse
 import zipfile
 import zipimport
 
@@ -39,6 +40,7 @@ except ImportError:
     from StringIO import StringIO   # NOQA
 
 import openerp
+import openerp.exceptions
 from openerp import modules, pooler, tools, addons
 from openerp.modules.db import create_categories
 from openerp.tools.parse_version import parse_version
@@ -619,40 +621,14 @@ class module(osv.osv):
         return res
 
     def download(self, cr, uid, ids, download=True, context=None):
-        res = []
-        default_version = modules.adapt_version('1.0')
-        for mod in self.browse(cr, uid, ids, context=context):
-            if not mod.url:
-                continue
-            match = re.search('-([a-zA-Z0-9\._-]+)(\.zip)', mod.url, re.I)
-            version = default_version
-            if match:
-                version = match.group(1)
-            if parse_version(mod.installed_version) >= parse_version(version):
-                continue
-            res.append(mod.url)
-            if not download:
-                continue
-            zip_content = urllib.urlopen(mod.url).read()
-            fname = modules.get_module_path(str(mod.name) + '.zip', downloaded=True)
-            try:
-                with open(fname, 'wb') as fp:
-                    fp.write(zip_content)
-            except Exception:
-                _logger.exception('Error when trying to create module '
-                                  'file %s', fname)
-                raise orm.except_orm(_('Error'), _('Can not create the module file:\n %s') % (fname,))
-            terp = self.get_module_info(mod.name)
-            self.write(cr, uid, mod.id, self.get_values_from_terp(terp))
-            cr.execute('DELETE FROM ir_module_module_dependency WHERE module_id = %s', (mod.id,))
-            self._update_dependencies(cr, uid, mod, terp.get('depends', []))
-            self._update_category(cr, uid, mod, terp.get('category', 'Uncategorized'))
-            # Import module
-            zimp = zipimport.zipimporter(fname)
-            zimp.load_module(mod.name)
-        return res
+        return []
 
     def install_from_urls(self, cr, uid, urls, context=None):
+        if not self.pool['res.users'].has_group(cr, uid, 'base.group_system'):
+            raise openerp.exceptions.AccessDenied()
+
+        apps_server = urlparse.urlparse(self.get_apps_server(cr, uid, context=context))
+
         OPENERP = 'openerp'
         tmp = tempfile.mkdtemp()
         _logger.debug('Install from url: %r', urls)
@@ -661,6 +637,11 @@ class module(osv.osv):
             for module_name, url in urls.items():
                 if not url:
                     continue    # nothing to download, local version is already the last one
+
+                up = urlparse.urlparse(url)
+                if up.scheme != apps_server.scheme or up.netloc != apps_server.netloc:
+                    raise openerp.exceptions.AccessDenied()
+
                 try:
                     _logger.info('Downloading module `%s` from OpenERP Apps', module_name)
                     content = urllib2.urlopen(url).read()
@@ -725,8 +706,8 @@ class module(osv.osv):
         finally:
             shutil.rmtree(tmp)
 
-    def install_by_names(self, cr, uid, names, context=None):
-        raise NotImplementedError('# TODO')
+    def get_apps_server(self, cr, uid, context=None):
+        return tools.config.get('apps_server', 'https://apps.openerp.com/apps')
 
     def _update_dependencies(self, cr, uid, mod_browse, depends=None):
         if depends is None:
diff --git a/openerp/addons/base/static/src/js/apps.js b/openerp/addons/base/static/src/js/apps.js
index eaaca6b13c3..13a9c2637b3 100644
--- a/openerp/addons/base/static/src/js/apps.js
+++ b/openerp/addons/base/static/src/js/apps.js
@@ -63,8 +63,8 @@ openerp.base = function(instance) {
             if (instance.base.apps_client) {
                 return check_client_available(instance.base.apps_client);
             } else {
-                var ICP = new instance.web.Model('ir.config_parameter');
-                return ICP.call('get_param', ['apps.server', 'https://apps.openerp.com/apps']).then(function(u) {
+                var Mod = new instance.web.Model('ir.module.module');
+                return Mod.call('get_apps_server').then(function(u) {
                     var link = $(_.str.sprintf('<a href="%s"></a>', u))[0];
                     var host = _.str.sprintf('%s//%s', link.protocol, link.host);
                     var dbname = link.pathname;