Commit Graph

165 Commits

Author SHA1 Message Date
andreparames 6b9b2274e5 [FIX] doc: http.route auth=public instead of admin
Removed the `admin` option, since it was removed on 04a5264, and added the
option `public`.

Fixes #9688
2015-12-11 10:52:52 +01:00
Stéphane Bidoul 8d58d985dd [FIX] http: no auto-load for modules not installable
Closes #8289
2015-09-09 13:56:55 +02:00
StefanRijnhart 3940a096b2 [FIX] http: Compatibility with psutil 3.0
Version 3.0 has replaced get_memory_info by memory_info.
Create wrapper to be able to use the correct one depending on the installed
version.
2015-06-16 08:59:44 +02:00
Alexis de Lattre 96135fa785 [FIX] http: correct authentication via JSON-RPC.
Since 31d817e, we rotate then session at login/logout.
Unfortunatly, `openerpframework.js` does not support session id change
at authentication and keep old one.

In order to keep compatibility with existing js clients (including 7.0
ones), we do not rotate the session at authentication.

Fixes #6948
Closes #6949
2015-06-05 12:38:39 +02:00
Jeremy Kersten daa69fb838 [FIX] http: avoid that request.not_found crash
return request.not_found crash with a internal error, because get_response
takes a environment as param.

Werkzeug Documentation:
Keep in mind that you have to pass an environment to get_response() because
some errors fetch additional information from the WSGI environment.
2015-06-01 10:30:16 +02:00
Christophe Simonis 291119c802 [FIX] http: `request.env` and request.cr` now raise `RuntimeError`.
These method used to raise an `AttributeError` when `self.registry`
returns `None`. Now raises a more appropriated exception.
2015-05-21 13:13:23 +02:00
Colin Newell 6e54c8d17a [FIX] web: avoid marking session as modified every time
The `rotate` flag introduced by 31d817e849
was initialized at the very end of the session init, after
the reset of the `modified` flag.
This had the side-effect of marking the session as modified
for every request, saving the session to disk every time
even without any change.

Closes #6795
2015-05-21 12:52:54 +02:00
Coin Newell 31d817e849 [FIX] web: rotate session identifiers after login/logout
As recommended by OWASP
https://www.owasp.org/index.php/Session_Management_Cheat_Sheet#Renew_the_Session_ID_After_Any_Privilege_Level_Change

Closes #6760
2015-05-19 01:45:46 +02:00
Raphael Collet fdc6ba1820 [FIX] http: make sure to instantiate an environment before calling method
This fixes an issue in property `field.digits` that cannot find a valid cursor
to the database.  Forcing the instantiation of an environment makes the cursor
retrievable.
2015-05-11 12:32:00 +02:00
Ravi Gohil 04de292885 [FIX] http: support old version of psutil
Add support for older versions of psutil (<1.2.0). Only used when
debug_rpc is enabled.

Closes #5108, #5163
2015-03-01 02:17:04 +01:00
Xavier Morel 88cc816670 [IMP] http: don't warn when using HTTPException results
When returning an HTTPException e.g. by calling ``request.not_found()``
which returns a ``werkzeug.exceptions.NotFound()``, the http system
would log a warning as HTTPException is neither a subclass of Odoo's
Response nor a subclass of werkzeug's BaseResponse.

Move the string response case about (for flow clarity), and convert
HTTPException instances to Werkzeug responses then fall into the normal
BaseResponse -> Response case to ultimately get an Odoo response object
out of the HTTPException instance.
2015-01-29 16:15:36 +01:00
Xavier Morel fca83b45f8 [IMP] on non-rpc debug, only break on non-HTTPException
Completes/improves fd6dde7ca

Because Werkzeug uses/provides flow-control exceptions via
HTTPException (which can be used as straight responses) they are used in
a few places of the web client, when triggering some redirections for
instance.

Breaking into the debugger for such mundane situations is surprising and
inconvenient for developers trying to debug actual issues in the system,
even though HTTPExceptions are by and large not error per-se, and
shouldn't warrant triggering post-mortem debugging.

So in the non-RPC dispatcher, don't post-mortem on HTTPException either.
2015-01-23 15:34:53 +01:00
Martin Trigaux 38fc04785a [FIX] http: log rpc.request and rpc.response handlers
The log level rec.request and rpc.response where no longer logged as
the webclient no longer uses XMLRPC but JSONRPC instead.
Duplicate the logging part from dispatch_rpc to dispatch method of JsonRequest
to add rpc logs when using JSON requests.
opw 617490
2015-01-13 15:50:29 +01:00
Antony Lesuisse f3a9a3d45b [FIX] http make psutil dependency optional 2015-01-07 03:34:03 +01:00
Christophe Simonis 44e401c983 [IMP] http.py: allow @route decorator to pass extra arguments to created werkzeug.routing.Rule 2014-12-12 19:34:31 +01:00
David Monjoie fd92f16801 [FIX] http: use default language when lang not in context 2014-12-12 15:11:08 +01:00
Mack ffda023295 [FIX] http.py: no traceback for SessionExpiredException
Rebase and close #3618
2014-12-02 18:34:28 +01:00
Xavier Morel fd6dde7ca0 [FIX] enable --debug for non-xmlrpc contexts
fixes #3102
2014-11-28 08:35:14 +01:00
Christophe Simonis ad98da68f3 [IMP] http: do not log traceback for Warnings 2014-11-24 13:52:36 +01:00
Christophe Simonis abcba53a7f [FIX] http.py: log 400 errors 2014-11-21 15:25:44 +01:00
Christophe Simonis 473fe9a331 [FIX] http.py: invalid request must return a status code 400 2014-11-20 16:06:55 +01:00
hiekmann fcf0b278a9 [FIX] corrected a word in a comment
closes #3423
2014-11-03 10:19:15 +01:00
Xavier Morel 9cd2693286 [FIX] JS tutorial 2014-10-07 10:23:50 +02:00
Sandy Carter e6dd2a63c1 Fix two possible AsciiErrors when an exception occurs
Signed-off-by: Sandy Carter <sandy.carter@savoirfairelinux.com>
2014-09-29 09:05:58 -04:00
Fabien Meghazi 6fd3982e23 [ADD] http.send_file() helper 2014-09-16 19:54:59 +02:00
Raphael Collet ab3ec1ef6c [IMP] openerp/http.py: accept mimetype application/json-rpc for json-rpc calls 2014-09-09 10:11:33 +02:00
Olivier Dony d32d120a0a [MERGE] Forward-port of saas-5 up to 9ce08b7 2014-09-08 16:54:10 +02:00
Xavier Morel 7558e2e786 [IMP] distribute branding on @groups instead of disabling edition
Avoids 2 rendering passes, and allows editing e.g. events detail page, which
couldn't be done (due to groups=public in a mail component)

fixes #1994
2014-09-08 11:16:06 +02:00
Fabien Meghazi c981d068ab [FIX] Restore /login redirection on SessionExpired
The feature was broken due to an incompatibility
when forward porting 624f256 and a78e27f
2014-09-05 16:24:59 +02:00
Christophe Simonis 0f122cc50c [FIX] http.py: session id is `sid` attribute 2014-09-01 15:49:26 +02:00
Xavier Morel cccd3c888f [ADD] openerp.http reference doc
* fix some docstrings so they can be autodoc'd
* intersphinx mapping (and links to) werkzeug and python
2014-09-01 14:16:14 +02:00
Fabien Meghazi 34c5a5cf9c [IMP] Increase statics cache from 12 hours to 1 week 2014-08-27 16:54:25 +02:00
Christophe Simonis e5b0933743 [FIX] data-dir management
- sessions are now shared between series.
- use site data dir instead of user data dir if user has no home dir.
- in http and module handling, `data-dir` was used before being
initialized, using the default value instead of user input

(fixes #308, #904)
2014-07-07 15:49:24 +02:00
Raphael Collet cbe2dbb672 [MERGE] new v8 api by rco
A squashed merge is required as the conversion of the apiculture branch from
bzr to git was not correctly done. The git history contains irrelevant blobs
and commits. This branch brings a lot of changes and fixes, too many to list
exhaustively.

- New orm api, objects are now used instead of ids
- Environements to encapsulates cr uid context while maintaining backward compatibility
- Field compute attribute is a new object oriented way to define function fields
- Shared browse record cache
- New onchange protocol
- Optional copy flag on fields
- Documentation update
- Dead code cleanup
- Lots of fixes
2014-07-06 17:05:41 +02:00
Olivier Dony 668b8c2b2d [FIX] Forward-port of saas-5 up to 0d330ca 2014-06-25 18:58:19 +02:00
Olivier Dony 0d330ca25c [MERGE] Forward-port of saas-4 up to fa739ac 2014-06-25 18:44:51 +02:00
Olivier Dony 4d488408b2 [MERGE] Forward-port of saas-3 up to 141e1b2 2014-06-25 18:34:03 +02:00
Olivier Dony 141e1b2615 [FIX] http.dispatch: call handle_exception() even w/ session missing/expired
This gives JSONRequests a chance to return
a proper JSON-RPC result when an HTTPException
is raised downstream, instead of returning a
plain HTML 404 error.
2014-06-25 17:41:40 +02:00
Christophe Simonis e862ff7033 [MERGE] forward port of branch saas-5 up to 4cb5381
Conflicts:
	openerp/addons/base/module/wizard/base_module_upgrade_view.xml
2014-06-22 15:36:10 +02:00
Christophe Simonis 4cb5381dee [MERGE] forward port of branch saas-4 up to 1f20f61 2014-06-22 15:33:22 +02:00
Christophe Simonis 1f20f61ab4 [MERGE] forward port of branch saas-3 up to 75884c3 2014-06-22 15:30:57 +02:00
Fabien Meghazi fef8077df3 git commit -a -mm 2014-06-18 16:56:46 +02:00
Fabien Meghazi 624f256f61 Changed as per the recommandation of Sir Odo 2014-06-18 14:31:16 +02:00
Xavier Morel e555855f07 [ADD] ability to trigger retrying rendering with an updated rendering context 2014-06-17 11:29:11 +02:00
Augustin Cisterne-Kaas 1dfa3946b5 [IMP] Db filter %h
Db filter %h skips www subdomain.
2014-06-05 16:09:04 +02:00
Christophe Simonis 70041a5f1b [FIX] routing_map: correct subclasses detection.
Subclass detection didn't include the class itself if all it's subclasses
were invalid. As we create a new regrouping subclass, that was always the
case after a registry reloading, causing subclassed controllers to not be
taken in account.

[IMP] routing_map: clean code a little bit
2014-06-03 17:55:34 +02:00
Christophe Simonis 45d42d0134 [FIX] http: change the way the routing map is build
Instead of only taking direct subclasses of controllers, take the lowest controller in the hierarchy
Allowing subclassing controllers
2014-06-02 15:38:02 +02:00
Olivier Dony 04211015fc [MERGE] Forward-port of latest saas-4 fixes, up to 0452851 2014-05-27 20:49:49 +02:00
Olivier Dony fd21abd847 [MERGE] Forward-port latest saas-3 bugfixes, up to 30f43da 2014-05-27 17:18:43 +02:00
Denis Ledoux 51c7b55da0 [FIX] request.handle_exception: cleanup override logic, fixed chain broken by commit a096ae0
handle_exception() is supposed to try handling an exception and if it cannot,
re-raise it. Overridden methods must therefore call super() within a try/except
block, and only attempt to handle the exception if super() raised.
2014-05-23 13:15:52 +02:00