diff options
| author | Christophe Matthieu <chm@openerp.com> | 2013-02-26 16:08:38 +0100 |
|---|---|---|
| committer | Christophe Matthieu <chm@openerp.com> | 2013-02-26 16:08:38 +0100 |
| commit | 66812c28e6e20aed1c09411b75d9349b1b2a8cfb (patch) | |
| tree | 3ace1517ae61fac9599fa6e5bf675c1292b42e16 /addons/web_linkedin/web_linkedin.py | |
| parent | f5cb973b1b5bdbd84fde9876b5c40d8a9067656a (diff) | |
| parent | 07199613cf0747dc36217f971e3d8cc7b6d6695c (diff) | |
[MERGE] from trunk
bzr revid: chm@openerp.com-20130226150838-3lpwgzoys9xmm8ju
Diffstat (limited to 'addons/web_linkedin/web_linkedin.py')
| -rw-r--r-- | addons/web_linkedin/web_linkedin.py | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/addons/web_linkedin/web_linkedin.py b/addons/web_linkedin/web_linkedin.py index 8c6fad8cd46..176b0cdfe20 100644 --- a/addons/web_linkedin/web_linkedin.py +++ b/addons/web_linkedin/web_linkedin.py @@ -21,6 +21,7 @@ import base64 import urllib2 +from urlparse import urlparse, urlunparse import openerp from openerp.osv import fields, osv @@ -29,7 +30,13 @@ class Binary(openerp.addons.web.http.Controller): _cp_path = "/web_linkedin/binary" @openerp.addons.web.http.jsonrequest - def url2binary(self, req,url): + def url2binary(self, req, url): + """Used exclusively to load images from LinkedIn profiles, must not be used for anything else.""" + req.session.assert_valid(force=True) + _scheme, _netloc, path, params, query, fragment = urlparse(url) + # media.linkedin.com is the master domain for LinkedIn media (replicated to CDNs), + # so forcing it should always work and prevents abusing this method to load arbitrary URLs + url = urlunparse(('http', 'media.linkedin.com', path, params, query, fragment)) bfile = urllib2.urlopen(url) return base64.b64encode(bfile.read()) |