[IMP] http: Sessions implicit deactivation

- Store a token inside sessions to allow implicit session deactivation when needed.

backport of @da1f153d61d747d9357694382fe04f96c0ca886a @c8243e71c6da37547a19f61c58f25d5d03e13d38

3 files changed, 13 insertions, 7 deletions

diff --git a/addons/auth_crypt/auth_crypt.py b/addons/auth_crypt/auth_crypt.py
index 7c9d0c5fa2c..c8ac4876a55 100644
--- a/addons/auth_crypt/auth_crypt.py
+++ b/addons/auth_crypt/auth_crypt.py
@@ -3,6 +3,7 @@ import logging
 from passlib.context import CryptContext
 
 import openerp
+from openerp import api
 from openerp.osv import fields, osv
 
 from openerp.addons.base.res import res_users
@@ -95,3 +96,7 @@ class res_users(osv.osv):
         internally
         """
         return default_crypt_context
+
+    @api.model
+    def _get_session_token_fields(self):
+        return super(res_users, self)._get_session_token_fields() | {'password_crypt'}
diff --git a/addons/auth_oauth/res_users.py b/addons/auth_oauth/res_users.py
index 60fdd7319a1..f89234a743e 100644
--- a/addons/auth_oauth/res_users.py
+++ b/addons/auth_oauth/res_users.py
@@ -6,6 +6,7 @@ import urllib2
 import json
 
 import openerp
+from openerp import api
 from openerp.addons.auth_signup.res_users import SignupError
 from openerp.osv import osv, fields
 from openerp import SUPERUSER_ID
@@ -125,4 +126,8 @@ class res_users(osv.Model):
             if not res:
                 raise
 
+    @api.model
+    def _get_session_token_fields(self):
+        return super(res_users, self)._get_session_token_fields() | {'oauth_access_token'}
+
 #
diff --git a/addons/web/controllers/main.py b/addons/web/controllers/main.py
index a1ead7e5d1a..158ae695268 100644
--- a/addons/web/controllers/main.py
+++ b/addons/web/controllers/main.py
@@ -37,6 +37,7 @@ from openerp.tools.misc import str2bool, xlwt
 from openerp import http
 from openerp.http import request, serialize_exception as _serialize_exception, content_disposition
 from openerp.exceptions import AccessError, UserError
+from openerp.service.report import exp_report, exp_report_get
 
 _logger = logging.getLogger(__name__)
 
@@ -1479,7 +1480,6 @@ class Reports(http.Controller):
     def index(self, action, token):
         action = json.loads(action)
 
-        report_srv = request.session.proxy("report")
         context = dict(request.context)
         context.update(action["context"])
 
@@ -1492,15 +1492,11 @@ class Reports(http.Controller):
                 report_ids = action['datas'].pop('ids')
             report_data.update(action['datas'])
 
-        report_id = report_srv.report(
-            request.session.db, request.session.uid, request.session.password,
-            action["report_name"], report_ids,
-            report_data, context)
+        report_id = exp_report(request.session.db, request.session.uid, action["report_name"], report_ids, report_data, context)
 
         report_struct = None
         while True:
-            report_struct = report_srv.report_get(
-                request.session.db, request.session.uid, request.session.password, report_id)
+            report_struct = exp_report_get(request.session.db, request.session.uid, report_id)
             if report_struct["state"]:
                 break