diff options
| author | Olivier Dony <odo@odoo.com> | 2018-10-02 01:00:37 +0200 |
|---|---|---|
| committer | Olivier Dony <odo@odoo.com> | 2018-10-02 01:00:37 +0200 |
| commit | 9bae56acd4ebe2b169ef635892b2cd9b6664a9d0 (patch) | |
| tree | 7d070c465a7f57b30e590f96ab0aa67fb669ecc4 /odoo | |
| parent | c47600887f8065365def44f3f8e85e9eff6f6d4b (diff) | |
[IMP] http: reinstate session rotation after login
Session rotation was introduced a long time ago, but deactivated at
login due to obscure side-effects related to #6949 (aka the "BBQ" PR).
This commit reinstates the rotation, which is better from a security
standpoint.
In order to also prevent session ID reuse, we force the renewal of
deleted sessions, at the SessionStore level (via `renew_missing`).
Diffstat (limited to 'odoo')
| -rw-r--r-- | odoo/http.py | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/odoo/http.py b/odoo/http.py index 3ae800cc71b..27d4d12fbca 100644 --- a/odoo/http.py +++ b/odoo/http.py @@ -1038,6 +1038,7 @@ class OpenERPSession(werkzeug.contrib.sessions.Session): uid = odoo.registry(db)['res.users'].authenticate(db, login, password, env) else: security.check(db, uid, password) + self.rotate = True self.db = db self.uid = uid self.login = login @@ -1299,7 +1300,8 @@ class Root(object): # Setup http sessions path = odoo.tools.config.session_dir _logger.debug('HTTP sessions stored in: %s', path) - return werkzeug.contrib.sessions.FilesystemSessionStore(path, session_class=OpenERPSession) + return werkzeug.contrib.sessions.FilesystemSessionStore( + path, session_class=OpenERPSession, renew_missing=True) @lazy_property def nodb_routing_map(self): @@ -1415,6 +1417,8 @@ class Root(object): if httprequest.session.rotate: self.session_store.delete(httprequest.session) httprequest.session.sid = self.session_store.generate_key() + if httprequest.session.uid: + httprequest.session.session_token = security.compute_session_token(httprequest.session, request.env) httprequest.session.modified = True self.session_store.save(httprequest.session) # We must not set the cookie if the session id was specified using a http header or a GET parameter. |