pengyuthon/odoo_source
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[IMP] http: reinstate session rotation after login

Browse Source 
Session rotation was introduced a long time ago, but deactivated at
login due to obscure side-effects related to #6949 (aka the "BBQ" PR).
This commit reinstates the rotation, which is better from a security
standpoint.

In order to also prevent session ID reuse, we force the renewal of
deleted sessions, at the SessionStore level (via `renew_missing`).
This commit is contained in:
Olivier Dony
2018-10-02 01:00:37 +02:00
parent c47600887f
commit 9bae56acd4
1 changed files with 5 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
odoo/http.py
+5 -1
View File
@@ -1038,6 +1038,7 @@ class OpenERPSession(werkzeug.contrib.sessions.Session):
uid = odoo.registry(db)['res.users'].authenticate(db, login, password, env) uid = odoo.registry(db)['res.users'].authenticate(db, login, password, env)
else: else:
security.check(db, uid, password) security.check(db, uid, password)
self.rotate = True
self.db = db self.db = db
self.uid = uid self.uid = uid
self.login = login self.login = login
@@ -1299,7 +1300,8 @@ class Root(object):
# Setup http sessions # Setup http sessions
path = odoo.tools.config.session_dir path = odoo.tools.config.session_dir
_logger.debug('HTTP sessions stored in: %s', path) _logger.debug('HTTP sessions stored in: %s', path)
return werkzeug.contrib.sessions.FilesystemSessionStore(path, session_class=OpenERPSession) return werkzeug.contrib.sessions.FilesystemSessionStore(
path, session_class=OpenERPSession, renew_missing=True)
@lazy_property @lazy_property
def nodb_routing_map(self): def nodb_routing_map(self):
@@ -1415,6 +1417,8 @@ class Root(object):
if httprequest.session.rotate: if httprequest.session.rotate:
self.session_store.delete(httprequest.session) self.session_store.delete(httprequest.session)
httprequest.session.sid = self.session_store.generate_key() httprequest.session.sid = self.session_store.generate_key()
if httprequest.session.uid:
httprequest.session.session_token = security.compute_session_token(httprequest.session, request.env)
httprequest.session.modified = True httprequest.session.modified = True
self.session_store.save(httprequest.session) self.session_store.save(httprequest.session)
# We must not set the cookie if the session id was specified using a http header or a GET parameter. # We must not set the cookie if the session id was specified using a http header or a GET parameter.