Julien Castiaux
944891ced0
SHA-1 is a cryptographic hash function that have weaknesses known since 2005, it has been deprecated by the NIST [1] about 10 years ago in 2011 and Google [2] have been able to perform a collision attack in 2017. We use SHA-1 as filename for the attachments stored in our filestore. Although practical attacks still requires quite a lot of computational resources, it is time to prevent SHA-1 collisions on our filestore. To prevent such attacks, when uploading a file that has the same SHA-1 as a stored file, we perform a SHA-2 computation on both files to verify their signature. If their SHA-2 signature is different, an error is raised. We have selected the SHA-512 variant of the SHA-2 algorithm because on 64 bits platform, SHA-512 is the fastest SHA-2 variant, it is only ~1.5x slower than SHA-1. [3] We have not used SHA-3 because at the moment of writing, it is too slow (~3x slower than SHA-1) [3] and it is not guaranteed to be available with the Python 3.5 `hashlib` module. [1]: https://csrc.nist.gov/projects/hash-functions/nist-policy-on-hash-functions [2]: https://shattered.io/ [3]: http://bench.cr.yp.to/results-hash.html [4]: http://www.commitstrip.com/en/2017/02/27/the-sha-1-alternative/ closes odoo/odoo#36430 Signed-off-by: Raphael Collet (rco) <rco@openerp.com>
Odoo
Odoo is a suite of web based open source business apps.
The main Odoo Apps include an Open Source CRM, Website Builder, eCommerce, Warehouse Management, Project Management, Billing & Accounting, Point of Sale, Human Resources, Marketing, Manufacturing, Purchase Management, ...
Odoo Apps can be used as stand-alone applications, but they also integrate seamlessly so you get a full-featured Open Source ERP when you install several Apps.
Getting started with Odoo
For a standard installation please follow the Setup instructions from the documentation.
Then follow the developer tutorials