From eb9a1c7d55bf4b07b5e516698a3b96a3f9f43d5b Mon Sep 17 00:00:00 2001
From: Xavier Morel <xmo@openerp.com>
Date: Mon, 26 Nov 2012 11:54:50 +0100
Subject: [REM] EVALPOCALYPSE PART ONE

bzr revid: xmo@openerp.com-20121126105450-0f6xowd3dhj4jmbl
---
 addons/web/http.py | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

(limited to 'addons/web/http.py')

diff --git a/addons/web/http.py b/addons/web/http.py
index fc80cb03864..3fc8f63231f 100644
--- a/addons/web/http.py
+++ b/addons/web/http.py
@@ -100,7 +100,7 @@ class WebRequest(object):
         # Determine self.lang
         lang = self.params.get('lang', None)
         if lang is None:
-            lang = self.session.eval_context(self.context).get('lang')
+            lang = self.context.get('lang')
         if lang is None:
             lang = self.httprequest.cookies.get('lang')
         if lang is None:
@@ -402,8 +402,10 @@ def session_context(request, session_store, session_lock, sid):
                 for k, v in request.session.iteritems():
                     stored = in_store.get(k)
                     if stored and isinstance(v, session.OpenERPSession):
-                        v.contexts_store.update(stored.contexts_store)
-                        v.domains_store.update(stored.domains_store)
+                        if hasattr(v, 'contexts_store'):
+                            del v.contexts_store
+                        if hasattr(v, 'domains_store'):
+                            del v.domains_store
                         if not hasattr(v, 'jsonp_requests'):
                             v.jsonp_requests = {}
                         v.jsonp_requests.update(getattr(
-- 
cgit v1.2.3


From 4a5cb1ebc478cb650a2bf33081f101e4f74bc6fe Mon Sep 17 00:00:00 2001
From: Xavier Morel <xmo@openerp.com>
Date: Mon, 26 Nov 2012 15:05:25 +0100
Subject: [REM] EVALPOCALYPSE PART 2: no more python-side eval

trigger an error if a nonliteral context is pushed to the server (through a new object_hook)

bzr revid: xmo@openerp.com-20121126140525-ni2x5m56upss610b
---
 addons/web/http.py | 17 ++++++++++-------
 1 file changed, 10 insertions(+), 7 deletions(-)

(limited to 'addons/web/http.py')

diff --git a/addons/web/http.py b/addons/web/http.py
index 3fc8f63231f..d0b04428f0d 100644
--- a/addons/web/http.py
+++ b/addons/web/http.py
@@ -17,7 +17,6 @@ import tempfile
 import threading
 import time
 import traceback
-import urllib
 import urlparse
 import uuid
 import xmlrpclib
@@ -33,7 +32,6 @@ import werkzeug.wsgi
 
 import openerp
 
-import nonliterals
 import session
 
 _logger = logging.getLogger(__name__)
@@ -95,7 +93,7 @@ class WebRequest(object):
         if not self.session:
             self.session = session.OpenERPSession()
             self.httpsession[self.session_id] = self.session
-        self.context = self.params.pop('context', None)
+        self.context = self.params.pop('context', {})
         self.debug = self.params.pop('debug', False) is not False
         # Determine self.lang
         lang = self.params.get('lang', None)
@@ -112,6 +110,11 @@ class WebRequest(object):
         # we use _ as seprator where RFC2616 uses '-'
         self.lang = lang.replace('-', '_')
 
+def reject_nonliteral(dct):
+    if '__ref' in dct:
+        raise ValueError(
+            "Non literal contexts can not be sent to the server anymore (%r)" % (dct,))
+    return dct
 
 class JsonRequest(WebRequest):
     """ JSON-RPC2 over HTTP.
@@ -182,9 +185,9 @@ class JsonRequest(WebRequest):
         try:
             # Read POST content or POST Form Data named "request"
             if requestf:
-                self.jsonrequest = simplejson.load(requestf, object_hook=nonliterals.non_literal_decoder)
+                self.jsonrequest = simplejson.load(requestf, object_hook=reject_nonliteral)
             else:
-                self.jsonrequest = simplejson.loads(request, object_hook=nonliterals.non_literal_decoder)
+                self.jsonrequest = simplejson.loads(request, object_hook=reject_nonliteral)
             self.init(self.jsonrequest.get("params", {}))
             if _logger.isEnabledFor(logging.DEBUG):
                 _logger.debug("--> %s.%s\n%s", method.im_class.__name__, method.__name__, pprint.pformat(self.jsonrequest))
@@ -233,10 +236,10 @@ class JsonRequest(WebRequest):
             # We need then to manage http sessions manually.
             response['httpsessionid'] = self.httpsession.sid
             mime = 'application/javascript'
-            body = "%s(%s);" % (jsonp, simplejson.dumps(response, cls=nonliterals.NonLiteralEncoder),)
+            body = "%s(%s);" % (jsonp, simplejson.dumps(response),)
         else:
             mime = 'application/json'
-            body = simplejson.dumps(response, cls=nonliterals.NonLiteralEncoder)
+            body = simplejson.dumps(response)
 
         r = werkzeug.wrappers.Response(body, headers=[('Content-Type', mime), ('Content-Length', len(body))])
         return r
-- 
cgit v1.2.3