Julien Castiaux
f04b90b6e8
This commit is the 12th commit of a comprehensive refactor of our HTTP framework. See odoo/odoo#78857 for complete historic, discussions and rationnals. The web module is twofold, on one side there are many controllers: /, /web, /web/login, /web/database/selector, /web/dataset/call_kw, etc, on the other side there is `session_info`: the method responsible to create the web client's environ. This module is kinda an exception as it is (with base) a server wide module. In the case of the HTTP framework, it means that the controllers of web are always accessible, i.e. going to / or /web/login will never return a 404 Not Found even if the user is not connected to a database. This is both a blessing and a curse. It is a blessing because the controllers are always accessible it means that a new users can freely access those routes. It is a curse because *any* user can access them, even user who don't have a session yet thus who are not connected to a database yet. From a developer standpoint, we have to put extra care to correct serve users with and without a database. An example is the /web/login route, the login/password pair is stored in a database, without database it is impossible to validate a user login but users can still access this route without db. To solve this problem, there is the `ensure_db` function. This function attempts to find a database using various sources (?db= query-string, session db, mono db) and to save it on the user session. In case no db is found, the user is redirected to the database selector. In a way, this function grants a database to the user in a seamingly experience. In a way, this function brings a welcome differentiation between `auth='none'` with a database and `auth='none'` without a database. Such differentiation only matters for the server wide modules as "regular" module controllers are only accessible via the ir.http routing map, i.e. it is not possible to declare a nodb controller outside of server wide modules. An important changement is the `session.authenticate` method, before it was possible to call the method when the cursor was not yet initialized, authenticate would open a cursor against the given database, setup a registry and an environment and ultimately save everything on the current request. Because the cursor is now greedily created, it is no more possible to update the request environment when authenticating on another database. PR: odoo#78857 Task: 2571224
20 lines
559 B
Python
20 lines
559 B
Python
# -*- coding: utf-8 -*-
|
|
# Part of Odoo. See LICENSE file for full copyright and licensing details.
|
|
|
|
from odoo import models
|
|
from odoo.http import request
|
|
|
|
|
|
class Http(models.AbstractModel):
|
|
_inherit = 'ir.http'
|
|
|
|
@classmethod
|
|
def _pre_dispatch(cls, rule, args):
|
|
super()._pre_dispatch(rule, args)
|
|
|
|
# add signup token or login to the session if given
|
|
for key in ('auth_signup_token', 'auth_login'):
|
|
val = request.httprequest.args.get(key)
|
|
if val is not None:
|
|
request.session[key] = val
|