Commit Graph
70 Commits
Author SHA1 Message Date
Christophe Simonis 5f2d080cf8 [MERGE] forward port branch 11.0 up to ad825b673b 2018-04-16 18:34:56 +02:00
Kiril Vangelovski ff07f078fa [FIX] base: reason json payload using get_data
Replace `httprequest.stream.read()` by `httprequest.get_data()` so the
payload content remains available: get_data stores the request body (by
default) so it remains available for alternative processing or checks
(MAC checks for webhook validations for instance). With `stream.read()`,
once the data is read if it's not stored separately it is lost.
2018-04-16 10:29:13 +02:00
Christophe Simonis 860dfb5586 [MERGE] forward port branch 11.0 up to d277adf4d5 2018-04-06 15:36:10 +02:00
Nicolas Martinelli 9b6ca49b58 [FIX] http: Bokmål language code
- Install Website
- Load the 'Norwegian Bokmål' translation, and choose to translate the
  website
- Logout

When accessing the website, the language displayed is not consistent to
the browser language.
1. `no` shows homepage in `nb_NO` (Firefox only) => expected since
    Bokmål is the main language in Norway
2. `nb` shows homepage in `en_US` => unexpected
3. `nn` shows homepage in `en_US` => expected since 'Norwegian Nynorsk'
   is not a language available (this will be the topic of another PR)

The issues comes from Babel's side, since `nb` is not in the
`LOCALE_ALIASES` while `no` is. We monkey-patch the value to avoid this
while Babel is corrected.

opw-1827258
2018-04-05 11:01:11 +02:00
Christophe Simonis e0345a4a3f [MERGE] forward port branch 11.0 up to 2835d29979 2018-03-20 11:45:11 +01:00
Christophe Simonis 672a275c7f [MERGE] forward port branch saas-15 up to 3d9a2340d9 2018-03-19 21:26:01 +01:00
tbe-odoo da1f153d61 [IMP] http: Sessions implicit deactivation
- Store a token inside sessions to allow implicit session deactivation when needed.
2018-03-19 18:11:12 +01:00
Christophe Simonis 7e469eb77a [MERGE] forward port branch 11.0 up to f5e7b86686 2018-02-01 18:15:21 +01:00
Christophe Simonis f5e7b86686 [MERGE] forward port branch saas-16 up to 920aa6174c 2018-02-01 17:02:19 +01:00
Christophe Simonis 920aa6174c [MERGE] forward port branch saas-15 up to e0422bfd6c 2018-02-01 16:40:13 +01:00
Jeremy Kersten e15a7b4c65 [FIX] http: JsonRequest return code error as status code
+ Manage 404 error, avoiding tb in log and respecting status code
in response request.
2018-02-01 09:47:25 +01:00
Christophe Simonis 9af65a7efe [MERGE] forward port branch saas-16 up to 0b188b5804 2018-01-29 13:37:12 +01:00
Christophe Simonis 0b188b5804 [MERGE] forward port branch saas-15 up to 2629029d03 2018-01-29 13:29:14 +01:00
tbe-odoo 6d682cea25 [REV] http: Implicit session deactivation -> Explicit destruction
- This commit degrade the performance and introduce a bug for multiple database servers.

This reverts commit bc69b47073.
2018-01-29 13:25:21 +01:00
Christophe Simonis cb50970f3f [MERGE] forward port branch 11.0 up to eefe879a37 2018-01-25 15:41:45 +01:00
Christophe Simonis c6b2fa47ed Revert "[FIX] base: bad back-port"
This reverts commit 0ac6043ec7.
2018-01-25 12:43:02 +01:00
tbe-odoo c0f004205d [FIX] http: Implicit session deactivation -> Explicit destruction
- Replace the implicit session deactivation with explicit destruction.
2018-01-24 10:58:06 +01:00
tbe-odoo bc69b47073 [FIX] http: Implicit session deactivation -> Explicit destruction
- Replace the implicit session deactivation with explicit destruction.
2018-01-23 16:21:10 +01:00
Christophe Simonis 4708812b6c [MERGE] forward port branch 11.0 up to b37cc1f9b7 2017-12-12 18:50:59 +01:00
Jeremy Kersten 294dc70a38 [FIX] http_routing, website: fix and clean routing
Clean method _add_dispatch_parameters
Remove unused code for caching

Call super before to have the correct lang when we browse website.
Without it, menu was not loaded in correct language.
2017-12-12 17:47:08 +01:00
Miquel Raïch a578531ca3 [FIX] v11 urls
Was still pointing to old links

Closes #21590
2017-12-12 17:19:01 +01:00
Dave Lasley 8226aa1db8 [IMP] http.py: Allow to use odoo if unmet dependencies on uninstalled module
Purpose
=======

If an external dependency is unmet on a module that is not installed, it's actually impossible to launch an odoo server and load the web client without getting a traceback.

This commit removes this constraint and allow to use odoo in that case. Obviously the install will crash if the external dependency is still unmet.

Close https://github.com/odoo/odoo/pull/17790
Coming from https://github.com/odoo/odoo/pull/14850
2017-11-29 16:21:12 +01:00
Christophe Simonis 29590a61cd [MERGE] forward port branch 11.0 up to 8fb25e185b 2017-11-28 16:57:58 +01:00
Xavier Morel b46830858f [FIX] web: excel export of binary fields
* In Python 3 xlwt apparently does not support writing bytes values ->
  try to decode assuming the value may be base64-encoded, this is more
  or less the behaviour for CSV exports.

  This will most likely not allow the export anyway as Excel cells are
  limited to 32k data characters, which accounting for base64
  expansion means ~24k worth of data, but that is a pre-existing
  issue.
* Also removed support for way outdated browsers from
  content_disposition: the Safari case is for Safari 5 (circa 2012)
  but versioning apparently changed since then and modern Safari
  report their "external" version number rather than the webkit
  version number => the current Safari reports version 11, and gets
  routed to the "does not support unicode file names", which is
  further bugged in Python 3 as it %s's bytes, leading to a resulting
  filename of e.g. `b'res.partner.csv'.csv` (with the prefix and
  quotes).
* The IE case is for IE8, which has long been unsupported by the web
  client.
2017-11-27 11:11:48 +01:00
rde e19c6a5ead [IMP] website: set viewid in frontend & save template for dispatch
This commit is related to enterprise commit adding crm_track option to routes.

Before this commit:
We could not get template's name after dispatch() had been called. Indeed,
it will remove the template name from the response (response.flatten()) to
make it not considered as 'qweb' anymore (is_qweb()).

In some case (e.g. website_crm_score), we still need the template's name later.
(Eg: to retrieve the route's view being rendered and check if trackable or not)

Add view-id in template, when main_object is not an ir_ui_view, it avoid to
make extra rpc to get the view_id.

this commit closes #20313
2017-10-23 14:31:07 +02:00
Laurent Smet c23ef9a9b6 [FIX] remove 'report' from rpc dispatcher
This feature no longer exists since 3425752eac

reported on github issue 19887
2017-10-09 10:03:22 +02:00
Christophe Monniez aaa30a74b5 [imp] module,http: open manifest files as utf-8 in a python2/3 compatible way 2017-10-03 12:01:53 +02:00
Christophe Simonis 3ac2a1106c [MERGE] forward port branch saas-15 up to ec15765eec 2017-09-11 13:30:03 +02:00
Fabien Meghazi 6fa705399b [FIX] http/db: handle case when db_filter is empty in the config file
In such a case the db filtering won't be applied on an empty regex so
we use the list of databases passed to `db_name` (--database) as
the database list (and we also avoid to list all the databases present
on the postgresql cluster)

As a side effect, this patch allows to strengthen the postgresql security
by preventing Odoo to list all the databases present on the cluster.
2017-09-08 18:29:26 +02:00
Christophe Simonis d5382abeaa [MERGE] forward port branch saas-17 up to b8dd34fcbb 2017-09-06 17:40:59 +02:00
Christophe Simonis 827b1e8e3d [FIX] P3: reraise exception correctly 2017-09-06 10:57:35 +02:00
Olivier Dony f4d541e51a [IMP] http: set HTTPonly flag on session cookie
This will reinforce the framework against potential XSS exploits
escalating to session hijack
2017-09-05 10:06:35 +02:00
Christophe Simonis 017ee5eab3 [MERGE] forward port branch saas-17 up to 877e709871 2017-08-24 13:17:53 +02:00
Xavier Morel a65dfe2421 [FIX] P3: exception semantics issues 2017-08-23 14:34:50 +02:00
Olivier Dony 695716efb0 [FIX] P3: remove pycompat.{keys,items,values} helpers
Now that we're closer to switching to P3 for good, these helpers have
outlived their usefulness, and mostly add noise.

All remaining dict.iter*() or dict.view*() must be converted to the
normal keys(), values() or items() calls.

Whenever the result is likely to be used for more than the scope of a
loop, or when the dict needs to be modified during iteration, the calls
must be wrapped in a ``list()``, to protect the new P3 semantics.
Those cases are very exceptional.

Also removed some dead code or improved the API to remove unnecessary
conversions.
2017-08-20 23:25:54 +02:00
Xavier Morel 555ff9ab84 [FIX] P3: quickfix URL/http text model 2017-08-20 23:25:54 +02:00
Xavier Morel 40d1246a17 [FIX] P3: Response wrapping in http
Explicitly check for both bytes and text results to wrap in a Response
object, as bytes is a string_type in P2 but not P3.
2017-08-20 23:25:54 +02:00
Xavier Morel b93613066f [FIX] P3: JSON is an object<->text encoding
It doesn't load bytes, and it doesn't dump to bytes.
2017-08-20 23:25:54 +02:00
Xavier Morel bc7dce254d [FIX] P3: text model, base_url is a string but query_string is bytes 2017-08-20 23:25:54 +02:00
Xavier Morel 481a00dc4b [FIX] P3: hash/hmac payload must be bytes 2017-08-20 23:25:54 +02:00
Xavier Morel 7dd062f835 [FIX] P3: text model types
* remove references to basestring & unicode (use relevant pycompat
  helpers)
* remove some str calls (either entirely or replaced by relevant
  helper, either text or native)
* use better API to avoid unnecessary conversions
* remove some XML declarations in views
2017-08-20 23:25:54 +02:00
Christophe Simonis 1fa8680286 [MERGE] forward port branch saas-17 up to 48b2ce60ed 2017-08-10 18:07:47 +02:00
Christophe Simonis 48b2ce60ed [MERGE] forward port branch saas-16 up to 85571bb78c 2017-08-10 17:01:05 +02:00
Christophe Simonis 85571bb78c [MERGE] forward port branch saas-15 up to dde62073ba 2017-08-10 16:22:36 +02:00
Christophe Simonis 40a82cdfda [FIX] http: ensure registry is still bound to the request before using it
A user can be logged out during a request, loosing the database (and
thus registry) information.
2017-08-08 19:14:05 +02:00
Fabien Meghazi 96af2823cb [FIX] http/db: fix bug introduced in b34e00540e
b34e00540e was not properly checking if db_name option was in use
2017-08-03 17:06:55 +02:00
Fabien Meghazi b34e00540e [IMP] http/db: change behaviour of list_dbs() when --db-filter is not provided (Closed #18526)
In case `--db-filter` is not provided and `--database` is passed,
Odoo will not fetch the list of databases available in the postgres
server anymore because it does not have anything to match against this
list. Instead, `list_dbs()` will use the value of `--database` as a
comma separated list of exposed databases.

This allows better security hardening in postgres access rights.

Basically, that means that those commands

    $ odoo-bin -d foobar
    $ odoo-bin -d foo,bar,baz

are now respectively equivalent to those commands

    $ odoo-bin -d foobar --db-filter='^foobar$'
    $ odoo-bin -d foo,bar,baz --db-filter='^(foo|bar|baz)$'

The old behaviour can still be used with this command:

    $ odoo-bin -d foobar --db-filter='.*'
2017-08-03 13:49:51 +02:00
Fabien Meghazi 2c0f6f39d7 [IMP] http: improve dumpstacks and remaining requests handling during tests (#18640)
This patch modifies Root#dispatch() in order to keep the httprequest url
in the current thread's attribute and use if for dumpstacks and the
phantomjs tests remaining requests handling.

Also added a counter in order to avoid looping forever when trying to join unclosed http requests
in phantomjs test suite after a phantomjs failure + added a log.warning in such a case so it's easier to troubleshoot runbot's ir.logging.
2017-08-03 10:50:18 +02:00
Ankit Joshi 16ebec2324 [FIX] http: avoid crash in web/database/selector when selecting invalid database (#17830) 2017-06-27 16:52:20 +02:00
Joren Van Onder b41a987767 [FIX] http: fix forward-port of eaa3682bb6
Forward-ported at
1b50c829ef. b4429c2a91
changed the import to allow for either urllib or urlparse.
2017-06-15 18:31:57 -07:00