Commit Graph
66 Commits
Author SHA1 Message Date
Christophe Simonis d45c32baac [MERGE] forward port branch saas-15 up to bdd051bf78 2018-06-13 18:13:48 +02:00
Toufik Benjaa c8243e71c6 [FIX] http: Consume less cursors for session checks
- Each time we check if a session is valid we create a new cursor.
  This could lead to issues with db_maxconn that limits the number of
connections to the postgresql server.
  In a perfect world, a worker should use a single connection to
postgres to process the request.
  The only known side effect is that the cursor is created earlier in
the execution of the code.

- This commit fixes issues with the longpolling raising
Psycopg2.PoolError exceptions on databases with a lot of clients.
2018-06-12 18:10:37 +02:00
Fabien Meghazi 32c5392f5f [ADD] http: addons preload opt-out for socket activation
Before this patch, early connections made to a 11.0 Odoo server running
on Python 3 and deployed in threaded mode with socket activation would
generate invalid registries.
With this patch it is now possible, when this deployment mode is used,
to opt-out addons preload by setting the following environment variable:

    ODOO_PRELOAD_ADDONS=no

Note: this environment variable is only available for v11.0 as later
versions does not preload anymore (cf: 1a39c9b)
2018-05-25 15:33:31 +02:00
Christophe Simonis 8383181b8f [MERGE] forward port branch saas-15 up to 021d0e6a98 2018-05-18 18:59:06 +02:00
Christophe Simonis bfda65d894 [MERGE] forward port branch 9.0 up to 612fd33fb1 2018-05-18 16:19:21 +02:00
Kiril Vangelovski ff07f078fa [FIX] base: reason json payload using get_data
Replace `httprequest.stream.read()` by `httprequest.get_data()` so the
payload content remains available: get_data stores the request body (by
default) so it remains available for alternative processing or checks
(MAC checks for webhook validations for instance). With `stream.read()`,
once the data is read if it's not stored separately it is lost.
2018-04-16 10:29:13 +02:00
Nicolas Martinelli 9b6ca49b58 [FIX] http: Bokmål language code
- Install Website
- Load the 'Norwegian Bokmål' translation, and choose to translate the
  website
- Logout

When accessing the website, the language displayed is not consistent to
the browser language.
1. `no` shows homepage in `nb_NO` (Firefox only) => expected since
    Bokmål is the main language in Norway
2. `nb` shows homepage in `en_US` => unexpected
3. `nn` shows homepage in `en_US` => expected since 'Norwegian Nynorsk'
   is not a language available (this will be the topic of another PR)

The issues comes from Babel's side, since `nb` is not in the
`LOCALE_ALIASES` while `no` is. We monkey-patch the value to avoid this
while Babel is corrected.

opw-1827258
2018-04-05 11:01:11 +02:00
Christophe Simonis 672a275c7f [MERGE] forward port branch saas-15 up to 3d9a2340d9 2018-03-19 21:26:01 +01:00
tbe-odoo da1f153d61 [IMP] http: Sessions implicit deactivation
- Store a token inside sessions to allow implicit session deactivation when needed.
2018-03-19 18:11:12 +01:00
Christophe Simonis f5e7b86686 [MERGE] forward port branch saas-16 up to 920aa6174c 2018-02-01 17:02:19 +01:00
Christophe Simonis 920aa6174c [MERGE] forward port branch saas-15 up to e0422bfd6c 2018-02-01 16:40:13 +01:00
Jeremy Kersten e15a7b4c65 [FIX] http: JsonRequest return code error as status code
+ Manage 404 error, avoiding tb in log and respecting status code
in response request.
2018-02-01 09:47:25 +01:00
Christophe Simonis 9af65a7efe [MERGE] forward port branch saas-16 up to 0b188b5804 2018-01-29 13:37:12 +01:00
Christophe Simonis 0b188b5804 [MERGE] forward port branch saas-15 up to 2629029d03 2018-01-29 13:29:14 +01:00
tbe-odoo 6d682cea25 [REV] http: Implicit session deactivation -> Explicit destruction
- This commit degrade the performance and introduce a bug for multiple database servers.

This reverts commit bc69b47073.
2018-01-29 13:25:21 +01:00
Christophe Simonis c6b2fa47ed Revert "[FIX] base: bad back-port"
This reverts commit 0ac6043ec7.
2018-01-25 12:43:02 +01:00
tbe-odoo c0f004205d [FIX] http: Implicit session deactivation -> Explicit destruction
- Replace the implicit session deactivation with explicit destruction.
2018-01-24 10:58:06 +01:00
tbe-odoo bc69b47073 [FIX] http: Implicit session deactivation -> Explicit destruction
- Replace the implicit session deactivation with explicit destruction.
2018-01-23 16:21:10 +01:00
Jeremy Kersten 294dc70a38 [FIX] http_routing, website: fix and clean routing
Clean method _add_dispatch_parameters
Remove unused code for caching

Call super before to have the correct lang when we browse website.
Without it, menu was not loaded in correct language.
2017-12-12 17:47:08 +01:00
Miquel Raïch a578531ca3 [FIX] v11 urls
Was still pointing to old links

Closes #21590
2017-12-12 17:19:01 +01:00
Xavier Morel b46830858f [FIX] web: excel export of binary fields
* In Python 3 xlwt apparently does not support writing bytes values ->
  try to decode assuming the value may be base64-encoded, this is more
  or less the behaviour for CSV exports.

  This will most likely not allow the export anyway as Excel cells are
  limited to 32k data characters, which accounting for base64
  expansion means ~24k worth of data, but that is a pre-existing
  issue.
* Also removed support for way outdated browsers from
  content_disposition: the Safari case is for Safari 5 (circa 2012)
  but versioning apparently changed since then and modern Safari
  report their "external" version number rather than the webkit
  version number => the current Safari reports version 11, and gets
  routed to the "does not support unicode file names", which is
  further bugged in Python 3 as it %s's bytes, leading to a resulting
  filename of e.g. `b'res.partner.csv'.csv` (with the prefix and
  quotes).
* The IE case is for IE8, which has long been unsupported by the web
  client.
2017-11-27 11:11:48 +01:00
Laurent Smet c23ef9a9b6 [FIX] remove 'report' from rpc dispatcher
This feature no longer exists since 3425752eac

reported on github issue 19887
2017-10-09 10:03:22 +02:00
Christophe Monniez aaa30a74b5 [imp] module,http: open manifest files as utf-8 in a python2/3 compatible way 2017-10-03 12:01:53 +02:00
Christophe Simonis 3ac2a1106c [MERGE] forward port branch saas-15 up to ec15765eec 2017-09-11 13:30:03 +02:00
Fabien Meghazi 6fa705399b [FIX] http/db: handle case when db_filter is empty in the config file
In such a case the db filtering won't be applied on an empty regex so
we use the list of databases passed to `db_name` (--database) as
the database list (and we also avoid to list all the databases present
on the postgresql cluster)

As a side effect, this patch allows to strengthen the postgresql security
by preventing Odoo to list all the databases present on the cluster.
2017-09-08 18:29:26 +02:00
Christophe Simonis d5382abeaa [MERGE] forward port branch saas-17 up to b8dd34fcbb 2017-09-06 17:40:59 +02:00
Christophe Simonis 827b1e8e3d [FIX] P3: reraise exception correctly 2017-09-06 10:57:35 +02:00
Olivier Dony f4d541e51a [IMP] http: set HTTPonly flag on session cookie
This will reinforce the framework against potential XSS exploits
escalating to session hijack
2017-09-05 10:06:35 +02:00
Christophe Simonis 017ee5eab3 [MERGE] forward port branch saas-17 up to 877e709871 2017-08-24 13:17:53 +02:00
Xavier Morel a65dfe2421 [FIX] P3: exception semantics issues 2017-08-23 14:34:50 +02:00
Olivier Dony 695716efb0 [FIX] P3: remove pycompat.{keys,items,values} helpers
Now that we're closer to switching to P3 for good, these helpers have
outlived their usefulness, and mostly add noise.

All remaining dict.iter*() or dict.view*() must be converted to the
normal keys(), values() or items() calls.

Whenever the result is likely to be used for more than the scope of a
loop, or when the dict needs to be modified during iteration, the calls
must be wrapped in a ``list()``, to protect the new P3 semantics.
Those cases are very exceptional.

Also removed some dead code or improved the API to remove unnecessary
conversions.
2017-08-20 23:25:54 +02:00
Xavier Morel 555ff9ab84 [FIX] P3: quickfix URL/http text model 2017-08-20 23:25:54 +02:00
Xavier Morel 40d1246a17 [FIX] P3: Response wrapping in http
Explicitly check for both bytes and text results to wrap in a Response
object, as bytes is a string_type in P2 but not P3.
2017-08-20 23:25:54 +02:00
Xavier Morel b93613066f [FIX] P3: JSON is an object<->text encoding
It doesn't load bytes, and it doesn't dump to bytes.
2017-08-20 23:25:54 +02:00
Xavier Morel bc7dce254d [FIX] P3: text model, base_url is a string but query_string is bytes 2017-08-20 23:25:54 +02:00
Xavier Morel 481a00dc4b [FIX] P3: hash/hmac payload must be bytes 2017-08-20 23:25:54 +02:00
Xavier Morel 7dd062f835 [FIX] P3: text model types
* remove references to basestring & unicode (use relevant pycompat
  helpers)
* remove some str calls (either entirely or replaced by relevant
  helper, either text or native)
* use better API to avoid unnecessary conversions
* remove some XML declarations in views
2017-08-20 23:25:54 +02:00
Christophe Simonis 1fa8680286 [MERGE] forward port branch saas-17 up to 48b2ce60ed 2017-08-10 18:07:47 +02:00
Christophe Simonis 48b2ce60ed [MERGE] forward port branch saas-16 up to 85571bb78c 2017-08-10 17:01:05 +02:00
Christophe Simonis 85571bb78c [MERGE] forward port branch saas-15 up to dde62073ba 2017-08-10 16:22:36 +02:00
Christophe Simonis 40a82cdfda [FIX] http: ensure registry is still bound to the request before using it
A user can be logged out during a request, loosing the database (and
thus registry) information.
2017-08-08 19:14:05 +02:00
Fabien Meghazi 96af2823cb [FIX] http/db: fix bug introduced in b34e00540e
b34e00540e was not properly checking if db_name option was in use
2017-08-03 17:06:55 +02:00
Fabien Meghazi b34e00540e [IMP] http/db: change behaviour of list_dbs() when --db-filter is not provided (Closed #18526)
In case `--db-filter` is not provided and `--database` is passed,
Odoo will not fetch the list of databases available in the postgres
server anymore because it does not have anything to match against this
list. Instead, `list_dbs()` will use the value of `--database` as a
comma separated list of exposed databases.

This allows better security hardening in postgres access rights.

Basically, that means that those commands

    $ odoo-bin -d foobar
    $ odoo-bin -d foo,bar,baz

are now respectively equivalent to those commands

    $ odoo-bin -d foobar --db-filter='^foobar$'
    $ odoo-bin -d foo,bar,baz --db-filter='^(foo|bar|baz)$'

The old behaviour can still be used with this command:

    $ odoo-bin -d foobar --db-filter='.*'
2017-08-03 13:49:51 +02:00
Fabien Meghazi 2c0f6f39d7 [IMP] http: improve dumpstacks and remaining requests handling during tests (#18640)
This patch modifies Root#dispatch() in order to keep the httprequest url
in the current thread's attribute and use if for dumpstacks and the
phantomjs tests remaining requests handling.

Also added a counter in order to avoid looping forever when trying to join unclosed http requests
in phantomjs test suite after a phantomjs failure + added a log.warning in such a case so it's easier to troubleshoot runbot's ir.logging.
2017-08-03 10:50:18 +02:00
Ankit Joshi 16ebec2324 [FIX] http: avoid crash in web/database/selector when selecting invalid database (#17830) 2017-06-27 16:52:20 +02:00
Joren Van Onder b41a987767 [FIX] http: fix forward-port of eaa3682bb6
Forward-ported at
1b50c829ef. b4429c2a91
changed the import to allow for either urllib or urlparse.
2017-06-15 18:31:57 -07:00
Joren Van Onder b31435ab5d [FIX] http: replace forward-ported urlparse with werkzeug.urls
Introduced by forward-port of eaa3682bb6
at ed2ddeccdf. At
01e3514147 urlparse was replaced with
werkzeug.urls.
2017-06-15 14:19:30 -07:00
Christophe Simonis ed2ddeccdf [MERGE] forward port branch saas-16 up to 1b50c829ef 2017-06-15 18:46:47 +02:00
Christophe Simonis 1b50c829ef [MERGE] forward port branch saas-15 up to 9713dc2e1f 2017-06-15 18:44:16 +02:00
Olivier Dony eaa3682bb6 [FIX] http: force protocol when missing in URL 2017-06-15 16:23:35 +02:00