Julien (jula)
af67d5223c
__Current behavior before commit:__ When the field `website_id` of a user is set, this user should only be able to login via this website (cfr. [this method][1]). This means that he can only login if [`get_current_website`][2] returns the same website as `website_id`. The issue is that when login with RPC, `dispatch_rpc` is making a [`borrow_request`][3] which hides the `request` object from the RPC layer. This has the consequence that `get_current_website` is not able to retrieve the website based on the url of the request. Thus preventing a user to login via RPC even if the domain used corresponds to the website set in its `website_id` field. __Description of the fix:__ Add the possibility to retrieve the current website via `threading.current_thread().url` (which is set [here][4]). This way it is possible to know the current website even if `borrow_request` has been used. __Steps tor reproduce:__ - Install `website` - Go to Website > Configuration > Websites - Set the domain of the first website (e.g. `http://localhost:8069/`) - Go to Marc Demo" res.partner form view - In Sales & Purchase tab set **Website** to "My Website" Then run this script in another terminal: ```python #!/usr/bin/env python3 import json import urllib.request url = "http://localhost:8069/jsonrpc" dbname = "db-16.0" def rpc_login_user_demo(): """ Login with demo using JSON-RPC :return: the user's id or False if login failed """ req = urllib.request.Request(url=url, data=json.dumps({ "params": { "service": "common", "method": "login", "args": [dbname, 'demo', 'demo'] }, }).encode(), headers={"Content-Type": "application/json"}) response = json.loads(urllib.request.urlopen(req).read().decode('UTF-8')) if response.get("error"): raise Exception(response["error"]) return response['result'] uid = rpc_login_user_demo() if uid: print("Login success") else: print("Login failed") ``` The login will fail but it should succeed since we sent the request with the same host than the website domain. opw-3742591 [1]: https://github.com/odoo/odoo/blob/0f7cbf2969b3c4b6c496e5b54814c4a9b3081af4/addons/website/models/res_users.py#L40 [2]: https://github.com/odoo/odoo/blob/0f7cbf2969b3c4b6c496e5b54814c4a9b3081af4/addons/website/models/website.py#L944 [3]: https://github.com/odoo/odoo/blob/0f7cbf2969b3c4b6c496e5b54814c4a9b3081af4/odoo/http.py#L361 [4]: https://github.com/odoo/odoo/blob/0f7cbf2969b3c4b6c496e5b54814c4a9b3081af4/odoo/http.py#L2037 closes odoo/odoo#157372 X-original-commit: b8bc400909012dd04d383287a1850bfc96dd0c5c Signed-off-by: Julien Castiaux (juc) <juc@odoo.com> Signed-off-by: Julien Launois (jula) <jula@odoo.com>
Odoo
Odoo is a suite of web based open source business apps.
The main Odoo Apps include an Open Source CRM, Website Builder, eCommerce, Warehouse Management, Project Management, Billing & Accounting, Point of Sale, Human Resources, Marketing, Manufacturing, ...
Odoo Apps can be used as stand-alone applications, but they also integrate seamlessly so you get a full-featured Open Source ERP when you install several Apps.
Getting started with Odoo
For a standard installation please follow the Setup instructions from the documentation.
To learn the software, we recommend the Odoo eLearning, or Scale-up, the business game. Developers can start with the developer tutorials