diff options
| -rw-r--r-- | addons/base_import_module/controllers/main.py | 6 | ||||
| -rw-r--r-- | openerp/cli/deploy.py | 21 |
2 files changed, 17 insertions, 10 deletions
diff --git a/addons/base_import_module/controllers/main.py b/addons/base_import_module/controllers/main.py index 0d2cdc1ab5b..4b51e69f096 100644 --- a/addons/base_import_module/controllers/main.py +++ b/addons/base_import_module/controllers/main.py @@ -21,7 +21,7 @@ class ImportModule(Controller): if not is_admin: raise openerp.exceptions.AccessError("Only administrators can upload a module") - @route('/base_import_module/login', type='http', auth='none', methods=['POST']) + @route('/base_import_module/login', type='http', auth='none', methods=['POST'], csrf=False) @webservice def login(self, login, password, db=None): if db and db != request.db: @@ -30,7 +30,9 @@ class ImportModule(Controller): if not uid: return Response(response="Wrong login/password", status=401) self.check_user(uid) - return "ok" + return Response(headers={ + 'X-CSRF-TOKEN': request.csrf_token(), + }) @route('/base_import_module/upload', type='http', auth='user', methods=['POST']) @webservice diff --git a/openerp/cli/deploy.py b/openerp/cli/deploy.py index 7c5e9536c0c..2e97d838ec2 100644 --- a/openerp/cli/deploy.py +++ b/openerp/cli/deploy.py @@ -17,21 +17,24 @@ class Deploy(Command): def deploy_module(self, module_path, url, login, password, db='', force=False): url = url.rstrip('/') - self.authenticate(url, login, password, db) + csrf_token = self.authenticate(url, login, password, db) module_file = self.zip_module(module_path) try: - return self.upload_module(url, module_file, force=force) + return self.upload_module(url, module_file, force=force, csrf_token=csrf_token) finally: os.remove(module_file) - def upload_module(self, server, module_file, force=False): + def upload_module(self, server, module_file, force=False, csrf_token=None): print("Uploading module file...") url = server + '/base_import_module/upload' - files = dict(mod_file=open(module_file, 'rb')) - force = '1' if force else '' - res = self.session.post(url, files=files, data=dict(force=force)) - if res.status_code != 200: - raise Exception("Could not authenticate on server '%s'" % server) + + post_data = {'force': '1' if force else ''} + if csrf_token: post_data['csrf_token'] = csrf_token + + with open(module_file, 'rb') as f: + res = self.session.post(url, files={'mod_file': f}, data=post_data) + res.raise_for_status() + return res.text def authenticate(self, server, login, password, db=''): @@ -47,6 +50,8 @@ class Deploy(Command): elif res.status_code != 200: raise Exception(res.text) + return res.headers.get('x-csrf-token') + def zip_module(self, path): path = os.path.abspath(path) if not os.path.isdir(path): |