[REM] website_mail: remove sha_in based message_post

The _message_post_helper() method historically allowed
passing a `sha_in` signature to let an unauthenticated
user post a message on a record.

This option is unused and an alternative is preferred:
passing a `token` value that matches the value of a
given field of the record.

In light of the increasingly grim future of SHA-1
as a cryptographic hash function, we consider it
better to entirely remove this specific option.

It has been unused for a while, and a simple
alternative exists.

As a temporary measure, the feature was also
deactivated in 10.0 at 2cffcfd860a8c035074ca123e01d8bf5f47ecc4e

2 files changed, 3 insertions, 37 deletions

diff --git a/addons/website_mail/controllers/main.py b/addons/website_mail/controllers/main.py
index c966b2bede7..c6fc592e3d8 100644
--- a/addons/website_mail/controllers/main.py
+++ b/addons/website_mail/controllers/main.py
@@ -7,24 +7,9 @@ from werkzeug.exceptions import NotFound
 from odoo import http
 from odoo.http import request
 
-
-def object_shasign(record=False, res_model='', res_id=None, **kw):
-    """ Generate a sha signature using the current time, database secret and the
-    record object or the res_model and res_id parameters
-        Return the sha signature and the time of generation in a tuple"""
-    secret = request.env['ir.config_parameter'].sudo().get_param('database.secret')
-    shasign = False
-    timestamp = int(time())
-    if record:
-        shasign = sha1('%s%s%s%s' % (record._name, record.id, secret, timestamp)).hexdigest()
-    elif res_model and res_id:
-        shasign = sha1('%s%s%s%s' % (res_model, res_id, secret, timestamp)).hexdigest()
-    return (shasign, timestamp)
-
-
-def _message_post_helper(res_model='', res_id=None, message='', token='', token_field='token', sha_in='', sha_time=None, nosubscribe=True, **kw):
+def _message_post_helper(res_model='', res_id=None, message='', token='', token_field='token', nosubscribe=True, **kw):
     """ Generic chatter function, allowing to write on *any* object that inherits mail.thread.
-        If a token or a shasign is specified, all logged in users will be able to write a message regardless
+        If a token is specified, all logged in users will be able to write a message regardless
         of access rights; if the user is the public user, the message will be posted under the name
         of the partner_id of the object (or the public user if there is no partner_id on the object).
 
@@ -36,12 +21,6 @@ def _message_post_helper(res_model='', res_id=None, message='', token='', token_
         :param string token: access token if the object's model uses some kind of public access
                              using tokens (usually a uuid4) to bypass access rules
         :param string token_field: name of the field that contains the token on the object (defaults to 'token')
-        :param string sha_in: sha1 hash of the string composed of res_model, res_id and the dabase secret in ir.config_parameter
-                               if you wish to allow public users to write on the object with some security but you don't want
-                               to add a token field on the object, the sha-sign prevents public users from writing to any other
-                               object that the one specified by res_model and res_id
-                               to generate the shasign, you can import the function object_shasign from this file in your controller
-        :param str sha_time: timestamp of sha signature generation (signatures are valid for 24h)
         :param bool nosubscribe: set False if you want the partner to be set as follower of the object when posting (default to True)
 
         The rest of the kwargs are passed on to message_post()
@@ -55,14 +34,6 @@ def _message_post_helper(res_model='', res_id=None, message='', token='', token_
         else:
             if not author_id:
                 raise NotFound()
-    elif sha_in:
-        timestamp = int(sha_time)
-        secret_sudo = request.env['ir.config_parameter'].sudo().get_param('database.secret')
-        shasign = sha1('%s%s%s%s' % (res_model, res_id, secret_sudo, timestamp))
-        if sha_in == shasign.hexdigest() and int(time()) < timestamp + 3600 * 24:
-            record = record.sudo()
-        else:
-            raise NotFound()
     return record.with_context(mail_create_nosubscribe=nosubscribe).message_post(body=message,
                                                                                    message_type=kw.pop('message_type', "comment"),
                                                                                    subtype=kw.pop('subtype', "mt_comment"),
diff --git a/addons/website_mail/views/website_mail_templates.xml b/addons/website_mail/views/website_mail_templates.xml
index 1c1ab5a38e0..824abeb0727 100644
--- a/addons/website_mail/views/website_mail_templates.xml
+++ b/addons/website_mail/views/website_mail_templates.xml
@@ -34,14 +34,11 @@
                          you can use a token to verify the identity of the user;
                          the message will be posted with the identity of the partner_id of the object
                 :token_field string (optional): name of the field that contains the token on the object (default to 'token')
-                :sha_in string (optional): if you use the shasign to allow commenting by non-logged user, you need to set it in this variable using the
-                                 object_shasign function defined in the main controller of website_portal
-                :sha_time string (optional): timestamp of the shasign generation
                 :chatter_mode string: 'json' or 'post' depending on what kind of request you want
         -->
         <section id="discussion" class="hidden-print oe_website_portal o_website_mail_thread">
             <t t-set="is_user_public" t-value="website.env.user == request.website.user_id"/>
-            <t t-set="can_comment" t-value="sha_in or token or not is_user_public"/>
+            <t t-set="can_comment" t-value="token or not is_user_public"/>
             <section class="mb32 hidden-print" t-if="can_comment">
                 <form class="o_website_chatter_form" t-attf-action="/website_mail/post/#{chatter_mode}" method="POST">
                     <input type="hidden" name="csrf_token" t-att-value="request.csrf_token()"/>
@@ -51,8 +48,6 @@
                         <input type='hidden' name="res_model" t-att-value="object._name"/>
                         <input type='hidden' name="res_id" t-att-value="object.id"/>
                         <input type='hidden' name="token" t-att-value="token" t-if="token"/>
-                        <input type='hidden' name="sha_in" t-att-value="sha_in" t-if="sha_in"/>
-                        <input type='hidden' name="sha_time" t-att-value="sha_time" t-if="sha_time"/>
                         <input type='hidden' name="token_field" t-att-value="token_field" t-if="token_field"/>
                         <div class="alert alert-danger mt8 mb0 o_website_chatter_error" style="display:none;">
                             Oops! Something went wrong. Try to reload the page and to log in.