From e1f5dfc388b1a5d8269b74cbde6b6f599a44f9ef Mon Sep 17 00:00:00 2001
From: Christophe Simonis <chs@openerp.com>
Date: Wed, 14 Nov 2012 12:33:35 +0100
Subject: [PATCH] [FIX] jsonp wasn't working on some browse due to security
 restriction that do not store the third parties cookies.

bzr revid: chs@openerp.com-20121114113335-nag3ljcwwx0yfdnu
---
 addons/web/http.py                  |  7 +++++++
 addons/web/static/src/js/corelib.js | 15 ++++++++++++---
 2 files changed, 19 insertions(+), 3 deletions(-)

diff --git a/addons/web/http.py b/addons/web/http.py
index 30fcf67ddd1..309bcb81135 100644
--- a/addons/web/http.py
+++ b/addons/web/http.py
@@ -227,6 +227,10 @@ class JsonRequest(WebRequest):
             _logger.debug("<--\n%s", pprint.pformat(response))
 
         if jsonp:
+            # If we use jsonp, that's mean we are called from another host
+            # Some browser (IE and Safari) do no allow third party cookies
+            # We need then to manage http sessions manually.
+            response['httpsessionid'] = self.httpsession.sid
             mime = 'application/javascript'
             body = "%s(%s);" % (jsonp, simplejson.dumps(response, cls=nonliterals.NonLiteralEncoder),)
         else:
@@ -364,6 +368,9 @@ def session_context(request, storage_path, session_cookie='httpsessionid'):
         STORES[storage_path] = session_store, session_lock
 
     sid = request.cookies.get(session_cookie)
+    if not sid:
+        sid = request.args.get('sid')
+
     with session_lock:
         if sid:
             request.session = session_store.get(sid)
diff --git a/addons/web/static/src/js/corelib.js b/addons/web/static/src/js/corelib.js
index 4012be526e6..5c4ef8b5cbb 100644
--- a/addons/web/static/src/js/corelib.js
+++ b/addons/web/static/src/js/corelib.js
@@ -1309,8 +1309,17 @@ instance.web.JsonRPC = instance.web.Class.extend(instance.web.PropertiesMixin, {
         // extracted from payload to set on the url
         var data = {
             session_id: this.session_id,
-            id: payload.id
+            id: payload.id,
+            sid: this.httpsessionid,
         };
+        
+        var set_sid = function (response, textStatus, jqXHR) {
+            // If response give us the http session id, we store it for next requests...
+            if (response.httpsessionid) {
+                self.httpsessionid = response.httpsessionid;
+            }
+        };
+
         url.url = this.get_url(url.url);
         var ajax = _.extend({
             type: "GET",
@@ -1326,7 +1335,7 @@ instance.web.JsonRPC = instance.web.Class.extend(instance.web.PropertiesMixin, {
         if(payload_url.length < 2000) {
             // Direct jsonp request
             ajax.data.r = payload_str;
-            return $.ajax(ajax);
+            return $.ajax(ajax).done(set_sid);
         } else {
             // Indirect jsonp request
             var ifid = _.uniqueId('oe_rpc_iframe');
@@ -1364,7 +1373,7 @@ instance.web.JsonRPC = instance.web.Class.extend(instance.web.PropertiesMixin, {
             });
             // append the iframe to the DOM (will trigger the first load)
             $form.after($iframe);
-            return deferred;
+            return deferred.done(set_sid);
         }
     },
     get_url: function (file) {