Nicolas Martinelli
79d29c51df
The use of the `deploy` command always fails because of an incorrect
CSRF token since commit 9bae56acd4. Indeed, the latter
re-introduces the session rotation, i.e. the session ID is changed at
authentication.
Practically, what happens server-side is:
- authentication
- generate CSRF token
- create the response with the token and a change of session ID
At this point, the token generated is not correct anymore since it is
based on the 'old' session ID. Therefore, when it is reused at
uploading, an error is raised.
It is actually possible to simplify the process by performing the
authentication and the file upload in a single request. There is indeed
no real use of extracting the authentication, since the request is then
only used to upload the module.
opw-1902863
closes odoo/odoo#28653
38 lines
1.2 KiB
Python
38 lines
1.2 KiB
Python
# -*- coding: utf-8 -*-
|
|
import functools
|
|
|
|
from odoo import _
|
|
from odoo.exceptions import AccessError
|
|
from odoo.http import Controller, route, request, Response
|
|
|
|
def webservice(f):
|
|
@functools.wraps(f)
|
|
def wrap(*args, **kw):
|
|
try:
|
|
return f(*args, **kw)
|
|
except Exception as e:
|
|
return Response(response=str(e), status=500)
|
|
return wrap
|
|
|
|
|
|
class ImportModule(Controller):
|
|
|
|
def check_user(self, uid=None):
|
|
if uid is None:
|
|
uid = request.uid
|
|
is_admin = request.env['res.users'].browse(uid)._is_admin()
|
|
if not is_admin:
|
|
raise AccessError(_("Only administrators can upload a module"))
|
|
|
|
@route(
|
|
'/base_import_module/login_upload',
|
|
type='http', auth='none', methods=['POST'], csrf=False, save_session=False)
|
|
@webservice
|
|
def login_upload(self, login, password, db=None, force='', mod_file=None, **kw):
|
|
if db and db != request.db:
|
|
raise Exception(_("Could not select database '%s'") % db)
|
|
uid = request.session.authenticate(request.db, login, password)
|
|
self.check_user(uid)
|
|
force = True if force == '1' else False
|
|
return request.env['ir.module.module'].import_zipfile(mod_file, force=force)[0]
|