From ebbff45cb59a87d57060e0452e72e0047d19042c Mon Sep 17 00:00:00 2001 From: Xavier Morel Date: Tue, 23 Jul 2013 17:56:51 +0200 Subject: [IMP] make trailing slashes irrelevant bzr revid: xmo@openerp.com-20130723155651-zdvnmldwankto1fa --- addons/web/http.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'addons/web/http.py') diff --git a/addons/web/http.py b/addons/web/http.py index f3ae2f34d6a..2fa58a5cd06 100644 --- a/addons/web/http.py +++ b/addons/web/http.py @@ -971,7 +971,7 @@ class Root(object): def _build_router(self, db): _logger.info("Generating routing configuration for database %s" % db) - routing_map = routing.Map() + routing_map = routing.Map(strict_slashes=False) def gen(modules, nodb_only): for module in modules: -- cgit v1.2.3 From d179a7f8caea3ab63d0a876ace11286c4c74f003 Mon Sep 17 00:00:00 2001 From: Xavier Morel Date: Tue, 23 Jul 2013 17:57:29 +0200 Subject: [FIX] unfuck set usage set("web") -> set(['b', 'e', 'w']), which won't do anything. Use set.discard which removes the value if present or noops if not. bzr revid: xmo@openerp.com-20130723155729-80y1psxd1h0o82s6 --- addons/web/http.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'addons/web/http.py') diff --git a/addons/web/http.py b/addons/web/http.py index 2fa58a5cd06..47eaa8f0b21 100644 --- a/addons/web/http.py +++ b/addons/web/http.py @@ -998,8 +998,8 @@ class Root(object): url = url[: -1] routing_map.add(routing.Rule(url, endpoint=function)) - modules_set = set(controllers_per_module.keys()) - modules_set -= set("web") + modules_set = set(controllers_per_module) + modules_set.discard('web') # building all none methods gen(["web"] + sorted(modules_set), True) if not db: -- cgit v1.2.3 From ed79dccf961e7c9001509c855ea94ba8be5706ca Mon Sep 17 00:00:00 2001 From: Xavier Morel Date: Tue, 23 Jul 2013 17:59:02 +0200 Subject: [IMP] simplify set use (no need to convert a set into a set) and remove unused variable bzr revid: xmo@openerp.com-20130723155902-pl0l4uti02zak35b --- addons/web/http.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'addons/web/http.py') diff --git a/addons/web/http.py b/addons/web/http.py index 47eaa8f0b21..2284c09a2d3 100644 --- a/addons/web/http.py +++ b/addons/web/http.py @@ -1009,9 +1009,9 @@ class Root(object): with registry.cursor() as cr: m = registry.get('ir.module.module') ids = m.search(cr, openerp.SUPERUSER_ID, [('state','=','installed')]) - installed = set([x['name'] for x in m.read(cr, 1, ids, ['name'])]) - modules_set = modules_set.intersection(set(installed)) - modules = ["web"] + sorted(modules_set) + installed = set(x['name'] for x in m.read(cr, 1, ids, ['name'])) + modules_set = modules_set & installed + # building all other methods gen(["web"] + sorted(modules_set), False) -- cgit v1.2.3 From 53b7baf1ce8a3143648e9d987899b03e0b36dfea Mon Sep 17 00:00:00 2001 From: niv-openerp Date: Fri, 13 Sep 2013 12:24:44 +0200 Subject: [FIX] fixed some problems related to magic guess of db, now only tries to perform the magic guess when the --dbfilter argument is specified bzr revid: nicolas.vanhoren@openerp.com-20130913102444-u30boym4nklatnf1 --- addons/web/http.py | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-) (limited to 'addons/web/http.py') diff --git a/addons/web/http.py b/addons/web/http.py index ccd1125fa22..c8fabafd594 100644 --- a/addons/web/http.py +++ b/addons/web/http.py @@ -1084,17 +1084,14 @@ def db_monodb(httprequest=None): dbs = db_list(True, httprequest) - # 1 try the db already in the session + # try the db already in the session db_session = httprequest.session.db if db_session in dbs: return db_session - # 2 if there is only one db in the db filters, take it - if len(dbs) == 1: - return dbs[0] - - # 3 if there are multiple dbs, take the first one only if we can list them - if len(dbs) > 1 and config['list_db']: + # if dbfilters was specified when launching the server and there is + # only one possible db, we take that one + if openerp.tools.config['dbfilter'] != ".*" and len(dbs) == 1: return dbs[0] return None -- cgit v1.2.3 From d4162cc0afee7805555f578beb1ddce0b838ed5d Mon Sep 17 00:00:00 2001 From: Christophe Simonis Date: Tue, 24 Sep 2013 12:41:01 +0200 Subject: [FIX] @route compatibility with version 7.0: */ add request.debug property */ inject request at first argument at runtime, do not use wrapper method. */ force slashes in routes (do not use os.path.join() for urls) */ routes defined using the legacy decorator httprequest and jsonrequest uses auth="none" */ avoid registring web module routes twice bzr revid: chs@openerp.com-20130924104101-h1dexy6m74b56gvi --- addons/web/http.py | 54 ++++++++++++++++++++++++------------------------------ 1 file changed, 24 insertions(+), 30 deletions(-) (limited to 'addons/web/http.py') diff --git a/addons/web/http.py b/addons/web/http.py index c8fabafd594..73e1843e401 100644 --- a/addons/web/http.py +++ b/addons/web/http.py @@ -177,6 +177,11 @@ class WebRequest(object): self.disable_db = True self.uid = None + @property + def debug(self): + return 'debug' in self.httprequest.args + + def auth_method_user(): request.uid = request.session.uid @@ -382,10 +387,10 @@ def jsonrequest(f): Use the ``route()`` decorator instead. """ f.combine = True - base = f.__name__ + base = f.__name__.lstrip('/') if f.__name__ == "index": base = "" - return route([base, os.path.join(base, "")], type="json", auth="user")(f) + return route([base, base + "/"], type="json", auth="none")(f) class HttpRequest(WebRequest): """ Regular GET/POST request @@ -460,10 +465,10 @@ def httprequest(f): Use the ``route()`` decorator instead. """ f.combine = True - base = f.__name__ + base = f.__name__.lstrip('/') if f.__name__ == "index": base = "" - return route([base, os.path.join(base, "")], type="http", auth="user")(f) + return route([base, base + "/"], type="http", auth="none")(f) #---------------------------------------------------------- # Local storage of requests @@ -496,16 +501,13 @@ class ControllerType(type): def __init__(cls, name, bases, attrs): super(ControllerType, cls).__init__(name, bases, attrs) - # create wrappers for old-style methods with req as first argument - cls._methods_wrapper = {} + # flag old-style methods with req as first argument for k, v in attrs.items(): if inspect.isfunction(v): spec = inspect.getargspec(v) first_arg = spec.args[1] if len(spec.args) >= 2 else None if first_arg in ["req", "request"]: - def build_new(nv): - return lambda self, *args, **kwargs: nv(self, request, *args, **kwargs) - cls._methods_wrapper[k] = build_new(v) + v._first_arg_is_req = True # store the controller in the controllers list name_class = ("%s.%s" % (cls.__module__, cls.__name__), cls) @@ -514,7 +516,6 @@ class ControllerType(type): return # we want to know all modules that have controllers module = class_path[2] - controllers_per_module.setdefault(module, []) # but we only store controllers directly inheriting from Controller if not "Controller" in globals() or not Controller in bases: return @@ -523,12 +524,6 @@ class ControllerType(type): class Controller(object): __metaclass__ = ControllerType - def get_wrapped_method(self, name): - if name in self.__class__._methods_wrapper: - return functools.partial(self.__class__._methods_wrapper[name], self) - else: - return getattr(self, name) - ############################# # OpenERP Sessions # ############################# @@ -991,8 +986,8 @@ class Root(object): cls = v[1] subclasses = cls.__subclasses__() - subclasses = [c for c in subclasses if c.__module__.split(".")[:2] == ["openerp", "addons"] and \ - cls.__module__.split(".")[2] in modules] + subclasses = [c for c in subclasses if c.__module__.startswith('openerp.addons.') and + c.__module__.split(".")[2] in modules] if subclasses: name = "%s (extended by %s)" % (cls.__name__, ', '.join(sub.__name__ for sub in subclasses)) cls = type(name, tuple(reversed(subclasses)), {}) @@ -1001,17 +996,15 @@ class Root(object): members = inspect.getmembers(o) for mk, mv in members: if inspect.ismethod(mv) and getattr(mv, 'exposed', False) and \ - nodb_only == (getattr(mv, "auth", None) == "none"): - function = (o.get_wrapped_method(mk), mv) + nodb_only == (getattr(mv, "auth", "none") == "none"): for url in mv.routes: if getattr(mv, "combine", False): - url = os.path.join(o._cp_path, url) + url = o._cp_path.rstrip('/') + '/' + url.lstrip('/') if url.endswith("/") and len(url) > 1: url = url[: -1] - routing_map.add(routing.Rule(url, endpoint=function)) + routing_map.add(routing.Rule(url, endpoint=mv)) - modules_set = set(controllers_per_module.keys()) - modules_set -= set("web") + modules_set = set(controllers_per_module.keys()) - set(['web']) # building all none methods gen(["web"] + sorted(modules_set), True) if not db: @@ -1020,12 +1013,12 @@ class Root(object): registry = openerp.modules.registry.RegistryManager.get(db) with registry.cursor() as cr: m = registry.get('ir.module.module') - ids = m.search(cr, openerp.SUPERUSER_ID, [('state','=','installed')]) + ids = m.search(cr, openerp.SUPERUSER_ID, [('state', '=', 'installed'), ('name', '!=', 'web')]) installed = set([x['name'] for x in m.read(cr, 1, ids, ['name'])]) modules_set = modules_set.intersection(set(installed)) modules = ["web"] + sorted(modules_set) # building all other methods - gen(["web"] + sorted(modules_set), False) + gen(modules, False) return routing_map @@ -1044,17 +1037,18 @@ class Root(object): """ path = request.httprequest.path urls = self.get_db_router(request.db).bind("") - matched, arguments = urls.match(path) + func, arguments = urls.match(path) arguments = dict([(k, v) for k, v in arguments.items() if not k.startswith("_ignored_")]) - func, original = matched def nfunc(*args, **kwargs): kwargs.update(arguments) + if getattr(func, '_first_arg_is_req', False): + args = (request,) + args return func(*args, **kwargs) request.func = nfunc - request.auth_method = getattr(original, "auth", "user") - request.func_request_type = original.exposed + request.auth_method = getattr(func, "auth", "user") + request.func_request_type = func.exposed root = None -- cgit v1.2.3 From af68d40f6a52dea93e7b817a6db04ba669e15581 Mon Sep 17 00:00:00 2001 From: Christophe Simonis Date: Mon, 7 Oct 2013 14:26:11 +0200 Subject: [FIX] http request must pop "session_id" also from `form` and `files` arguments bzr revid: chs@openerp.com-20131007122611-i92dl924plmo02z3 --- addons/web/http.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'addons/web/http.py') diff --git a/addons/web/http.py b/addons/web/http.py index 73e1843e401..3699b993521 100644 --- a/addons/web/http.py +++ b/addons/web/http.py @@ -400,12 +400,12 @@ class HttpRequest(WebRequest): def __init__(self, *args): super(HttpRequest, self).__init__(*args) params = dict(self.httprequest.args) + params.update(self.httprequest.form) + params.update(self.httprequest.files) ex = set(["session_id"]) for k in params.keys(): if k in ex: del params[k] - params.update(self.httprequest.form) - params.update(self.httprequest.files) self.params = params def dispatch(self): -- cgit v1.2.3 From 34d2fd4d022f9c29f06abe2730fc5695b0d39c74 Mon Sep 17 00:00:00 2001 From: Christophe Simonis Date: Fri, 11 Oct 2013 13:34:50 +0200 Subject: [FIX] web: request dispatching wraps controller function call to retry request if psycopg raise OperationError and convert IntegrityError into except_orm with translated message. bzr revid: chs@openerp.com-20131011113450-ktoaxul22p3nql75 --- addons/web/http.py | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) (limited to 'addons/web/http.py') diff --git a/addons/web/http.py b/addons/web/http.py index 3699b993521..b02a83ee746 100644 --- a/addons/web/http.py +++ b/addons/web/http.py @@ -35,7 +35,7 @@ import urllib import urllib2 import openerp -import openerp.service.security as security +from openerp.service import security, model as service_model from openerp.tools import config import inspect @@ -1040,10 +1040,17 @@ class Root(object): func, arguments = urls.match(path) arguments = dict([(k, v) for k, v in arguments.items() if not k.startswith("_ignored_")]) + @service_model.check + def checked_call(dbname, *a, **kw): + return func(*a, **kw) + def nfunc(*args, **kwargs): kwargs.update(arguments) if getattr(func, '_first_arg_is_req', False): args = (request,) + args + + if request.db: + return checked_call(request.db, *args, **kwargs) return func(*args, **kwargs) request.func = nfunc -- cgit v1.2.3 From 687161f2232e6e2c270966e8136bcd8a9bec0f9a Mon Sep 17 00:00:00 2001 From: Christophe Simonis Date: Tue, 15 Oct 2013 11:07:19 +0200 Subject: [FIX] web: re-add registry_cr() method on request to be compatible with saas-1 branch bzr revid: chs@openerp.com-20131015090719-kw3ywyqix5ejcsak --- addons/web/http.py | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'addons/web/http.py') diff --git a/addons/web/http.py b/addons/web/http.py index b02a83ee746..4f27fb51a36 100644 --- a/addons/web/http.py +++ b/addons/web/http.py @@ -21,6 +21,7 @@ import urlparse import uuid import errno import re +import warnings import babel.core import simplejson @@ -181,6 +182,10 @@ class WebRequest(object): def debug(self): return 'debug' in self.httprequest.args + @contextlib.contextmanager + def registry_cr(self): + warnings.warn('please use request.registry and request.cr directly', DeprecationWarning) + yield (self.registry, self.cr) def auth_method_user(): request.uid = request.session.uid -- cgit v1.2.3 From 96f30d058f9cbe16a4cc70b83cb71ad3277a2c5f Mon Sep 17 00:00:00 2001 From: Xavier Morel Date: Tue, 15 Oct 2013 11:31:14 +0200 Subject: [REM] useless leftover crap bzr revid: xmo@openerp.com-20131015093114-15a2jsmsbveqxuw4 --- addons/web/http.py | 6 ------ 1 file changed, 6 deletions(-) (limited to 'addons/web/http.py') diff --git a/addons/web/http.py b/addons/web/http.py index d2d3a78cf06..22b5522fa22 100644 --- a/addons/web/http.py +++ b/addons/web/http.py @@ -409,12 +409,6 @@ class HttpRequest(WebRequest): self.params = params def dispatch(self): - akw = {} - for key, value in self.httprequest.args.iteritems(): - if isinstance(value, basestring) and len(value) < 1024: - akw[key] = value - else: - akw[key] = type(value) try: r = self._call_function(**self.params) except werkzeug.exceptions.HTTPException, e: -- cgit v1.2.3 From 5e9dd279c16f5d2eb5a6e53f869ffc379672f490 Mon Sep 17 00:00:00 2001 From: Xavier Morel Date: Tue, 15 Oct 2013 11:42:16 +0200 Subject: [IMP] sensible implementation of set_request bzr revid: xmo@openerp.com-20131015094216-sgsfukzndfpu8kss --- addons/web/http.py | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) (limited to 'addons/web/http.py') diff --git a/addons/web/http.py b/addons/web/http.py index 22b5522fa22..96b7275343d 100644 --- a/addons/web/http.py +++ b/addons/web/http.py @@ -471,18 +471,20 @@ from werkzeug.local import LocalStack _request_stack = LocalStack() -def set_request(request): - class with_obj(object): - def __enter__(self): - _request_stack.push(request) - def __exit__(self, *args): - _request_stack.pop() - return with_obj() +@contextlib.contextmanager +def set_request(req): + _request_stack.push(req) + try: + yield + finally: + _request_stack.pop() + + +request = _request_stack() """ A global proxy that always redirect to the current request object. """ -request = _request_stack() #---------------------------------------------------------- # Controller registration with a metaclass -- cgit v1.2.3 From bd6efcfc1473b519a637fbe2a24ff5d9282c60f4 Mon Sep 17 00:00:00 2001 From: Xavier Morel Date: Tue, 15 Oct 2013 11:53:07 +0200 Subject: [FIX] removal of session_id from params, may not be only in GET params bzr revid: xmo@openerp.com-20131015095307-3m1gc71dt3zihm26 --- addons/web/http.py | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) (limited to 'addons/web/http.py') diff --git a/addons/web/http.py b/addons/web/http.py index 96b7275343d..b5d5fae3d63 100644 --- a/addons/web/http.py +++ b/addons/web/http.py @@ -400,12 +400,10 @@ class HttpRequest(WebRequest): def __init__(self, *args): super(HttpRequest, self).__init__(*args) params = dict(self.httprequest.args) - ex = set(["session_id"]) - for k in params.keys(): - if k in ex: - del params[k] params.update(self.httprequest.form) params.update(self.httprequest.files) + + params.pop('session_id', None) self.params = params def dispatch(self): -- cgit v1.2.3 From 0ded676e72ec5421a865b155cb0d78dfa0318dc9 Mon Sep 17 00:00:00 2001 From: niv-openerp Date: Thu, 17 Oct 2013 10:48:18 +0200 Subject: [FIX] changed back default authetication level of old routes to "user" to remove inconsistency bzr revid: nicolas.vanhoren@openerp.com-20131017084818-ijen4a2ywyg9lrxe --- addons/web/http.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'addons/web/http.py') diff --git a/addons/web/http.py b/addons/web/http.py index 4f27fb51a36..7e12a71e44a 100644 --- a/addons/web/http.py +++ b/addons/web/http.py @@ -395,7 +395,7 @@ def jsonrequest(f): base = f.__name__.lstrip('/') if f.__name__ == "index": base = "" - return route([base, base + "/"], type="json", auth="none")(f) + return route([base, base + "/"], type="json", auth="user")(f) class HttpRequest(WebRequest): """ Regular GET/POST request @@ -473,7 +473,7 @@ def httprequest(f): base = f.__name__.lstrip('/') if f.__name__ == "index": base = "" - return route([base, base + "/"], type="http", auth="none")(f) + return route([base, base + "/"], type="http", auth="user")(f) #---------------------------------------------------------- # Local storage of requests -- cgit v1.2.3 From 7636d71dfcff09648d080ea4513871a0e27b08ad Mon Sep 17 00:00:00 2001 From: niv-openerp Date: Fri, 18 Oct 2013 14:57:27 +0200 Subject: [FIX] potential bug in server-side web framework, now forbids users to call method when not authentified bzr revid: nicolas.vanhoren@openerp.com-20131018125727-qtkzkiwkhw4z78kr --- addons/web/http.py | 2 ++ 1 file changed, 2 insertions(+) (limited to 'addons/web/http.py') diff --git a/addons/web/http.py b/addons/web/http.py index 7e12a71e44a..4bda58117d4 100644 --- a/addons/web/http.py +++ b/addons/web/http.py @@ -189,6 +189,8 @@ class WebRequest(object): def auth_method_user(): request.uid = request.session.uid + if not request.uid: + raise SessionExpiredException("Session expired") def auth_method_admin(): if not request.db: -- cgit v1.2.3