[MERGE] forward port branch 10.0 up to 788750ea513

1 files changed, 6 insertions, 4 deletions

diff --git a/odoo/http.py b/odoo/http.py
index 84298c20a63..0075b1bed34 100644
--- a/odoo/http.py
+++ b/odoo/http.py
@@ -1047,7 +1047,7 @@ class OpenERPSession(werkzeug.contrib.sessions.Session):
         self.db = db
         self.uid = uid
         self.login = login
-        self.session_token = uid and security.compute_session_token(self)
+        self.session_token = uid and security.compute_session_token(self, request.env)
         request.uid = uid
         request.disable_db = False
 
@@ -1062,15 +1062,17 @@ class OpenERPSession(werkzeug.contrib.sessions.Session):
         """
         if not self.db or not self.uid:
             raise SessionExpiredException("Session expired")
-
+        # We create our own environment instead of the request's one.
+        # to avoid creating it without the uid since request.uid isn't set yet
+        env = odoo.api.Environment(request.cr, self.uid, self.context)
         #  == BACKWARD COMPATIBILITY TO CONVERT OLD SESSION TYPE TO THE NEW ONES ! REMOVE ME AFTER 11.0 ==
         if self.get('password'):
             security.check(self.db, self.uid, self.password)
-            self.session_token = security.compute_session_token(self)
+            self.session_token = security.compute_session_token(self, env)
             self.pop('password')
         # =================================================================================================
         # here we check if the session is still valid
-        if not security.check_session(self):
+        if not security.check_session(self, env):
             raise SessionExpiredException("Session expired")
 
     def logout(self, keep_db=False):