[FIX] core: compatibility with Werkzeug 0.15 ProxyFix

Werkzeug 0.15 modified ProxyFix such that by default it only forwards
the REMOTE_ADDR when enabled, whereas before 0.15 it would also
forward scheme and host. This breaks proxied odoo as the base url
becomes incorrect (cf #34412).

Use properly configured ProxyFix when running with werkzeug 0.15, old
configuration otherwise.

Closes #35085

closes odoo/odoo#36212

Signed-off-by: Xavier Morel (xmo) <xmo@odoo.com>

1 files changed, 15 insertions, 1 deletions

diff --git a/odoo/service/wsgi_server.py b/odoo/service/wsgi_server.py
index 23acfefad03..c29d91a2fbc 100644
--- a/odoo/service/wsgi_server.py
+++ b/odoo/service/wsgi_server.py
@@ -121,8 +121,22 @@ def application_unproxied(environ, start_response):
     # We never returned from the loop.
     return werkzeug.exceptions.NotFound("No handler found.\n")(environ, start_response)
 
+try:
+    # werkzeug >= 0.15
+    from werkzeug.middleware.proxy_fix import ProxyFix as ProxyFix_
+    # 0.15 also supports port and prefix, but 0.14 only forwarded for, proto
+    # and host so replicate that
+    ProxyFix = lambda app: ProxyFix_(app, x_for=1, x_proto=1, x_host=1)
+except ImportError:
+    # werkzeug < 0.15
+    from werkzeug.contrib.fixers import ProxyFix
+
 def application(environ, start_response):
+    # FIXME: is checking for the presence of HTTP_X_FORWARDED_HOST really useful?
+    #        we're ignoring the user configuration, and that means we won't
+    #        support the standardised Forwarded header once werkzeug supports
+    #        it
     if config['proxy_mode'] and 'HTTP_X_FORWARDED_HOST' in environ:
-        return werkzeug.contrib.fixers.ProxyFix(application_unproxied)(environ, start_response)
+        return ProxyFix(application_unproxied)(environ, start_response)
     else:
         return application_unproxied(environ, start_response)