From 9c4eab3ef475b5d04d4944e335cb7f7b41235995 Mon Sep 17 00:00:00 2001 From: Romain Derie Date: Thu, 29 Nov 2018 09:43:31 +0000 Subject: [PATCH] [FIX] website: ensure only editor can force website with URL 'fw' Before this commit, everyone could use the `fw` query string to force a website during the dispatching. Plus, it would not require multi-website to be enabled (multi-website only display UI elements, it does not affect behaviors as they are already triggered even if multi-website is disabled). This was intended but caused an issue for public users. Indeed, the code that would force a website during the http dispatching would be executed in `_add_dispatch_parameters`, after the auth methods. Then, the request.uid would be the one from the website we were leaving and not the one of the website we are forcing. Public user would then not be recognized as such (if both websites have their own public user) and would have interface glitchs (considered as connected). Note: Next reload or page navigation would set the request.uid correctly. Now: To avoid such a behavior, we decided to allow only designer user to be able to switch website with the `fw` query string, and only if multi-website is enabled. Note: The designer group check is done on the leaving website and not the forcing one as `_add_dispatch_parameters` is executed after auth methods. There is no way to check with which user the user will be logged on the forcing website (Public, Same user, different user?). Also, it would have to handle the same domain/different domain. Step to reproduce: - Activate multi-website - Activate multi-company - Create SiteA and SiteB - Create CompanyA and CompanyB - Set CompanyA on SiteA and CompanyB on SiteB - A new public user will be bootstraped for CompanyB - Optionnaly, setting manually a different public user for CompanyB will do the same. - Go to website 1, request.uid is PubUserA and request.website is SiteA - Navigate to website 2 with `?fw=2` in URL, request.uid will be PubUserA and request.website will be SiteB. This is wrong, request.uid should be PubUserB as we are on SiteB This will result in multiple bug, mainly the non logged user will see the dropdown in the navbar as if they were logged in showing 'PubUserA'. Fixes #27998 closes odoo/odoo#29136 --- addons/website/models/ir_http.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/addons/website/models/ir_http.py b/addons/website/models/ir_http.py index 7ca7563159b..49e06997692 100644 --- a/addons/website/models/ir_http.py +++ b/addons/website/models/ir_http.py @@ -74,7 +74,9 @@ class Http(models.AbstractModel): # Force website with query string paramater, typically set from website selector in frontend navbar force_website_id = request.httprequest.args.get('fw') - if force_website_id and request.session.get('force_website_id') != force_website_id: + if (force_website_id and request.session.get('force_website_id') != force_website_id and + request.env.user.has_group('website.group_multi_website') and + request.env.user.has_group('website.group_website_publisher')): request.env['website']._force_website(request.httprequest.args.get('fw')) context = {}