From fd863b850179fe0337861cf4c1a66d5e4d94dc62 Mon Sep 17 00:00:00 2001 From: niv-openerp Date: Tue, 5 Nov 2013 11:15:48 +0100 Subject: [PATCH 1/2] [FIX] potential bug with the /login url, it could not possibly work due to its authorization level. Also modified a function that is supposed to redirect to the backend and was still using '/'. bzr revid: nicolas.vanhoren@openerp.com-20131105101548-jdsnyh2j4ak0kdbk --- addons/web/controllers/main.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/addons/web/controllers/main.py b/addons/web/controllers/main.py index 9f0c7daa0f8..d4b59c7069c 100644 --- a/addons/web/controllers/main.py +++ b/addons/web/controllers/main.py @@ -348,7 +348,7 @@ def make_conditional(response, last_modified=None, etag=None): response.set_etag(etag) return response.make_conditional(request.httprequest) -def login_and_redirect(db, login, key, redirect_url='/'): +def login_and_redirect(db, login, key, redirect_url='/web'): request.session.authenticate(db, login, key) return set_cookie_and_redirect(redirect_url) @@ -569,7 +569,7 @@ class Home(http.Controller): } return request.make_response(r, {'Cache-Control': 'no-cache', 'Content-Type': 'text/html; charset=utf-8'}) - @http.route('/login', type='http', auth="user") + @http.route('/login', type='http', auth="none") def login(self, db, login, key): return login_and_redirect(db, login, key) From 684c6295560e23fa4d65642ef197fd7abf69903b Mon Sep 17 00:00:00 2001 From: Fabien Meghazi Date: Tue, 5 Nov 2013 11:20:36 +0100 Subject: [PATCH 2/2] [FIX] session destroy Sorry all bzr revid: fme@openerp.com-20131105102036-34g9mk2u694eqvhn --- addons/web/controllers/main.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/addons/web/controllers/main.py b/addons/web/controllers/main.py index d4b59c7069c..2a211347b65 100644 --- a/addons/web/controllers/main.py +++ b/addons/web/controllers/main.py @@ -930,7 +930,7 @@ class Session(http.Controller): request.session.logout() @http.route('/web/session/logout', type='http', auth="user") - def destroy(self, redirect='/'): + def logout(self, redirect='/'): request.session.logout() return werkzeug.utils.redirect(redirect, 303)