From dccbf425a1742c08564d4f7b223ce27f8746c832 Mon Sep 17 00:00:00 2001 From: Xavier Morel Date: Fri, 6 Mar 2020 14:45:21 +0000 Subject: [FIX] core: ensure we create a new session for each tour The browser itself would get mostly cleaned up between tours, but the session object would not get cleaned, and apparently in some cases that could lead to an incoherent session: a tour would add data to the session which the next tour (logging in as a different user) would not (fully) override, leading to a session inconsistency and a Session Expired exception during the tour. Fix by not storing the session on the test object, the session is created during authentication then set on the opener & browser. --- odoo/tests/common.py | 55 +++++++++++++++++++++++++++++----------------------- 1 file changed, 31 insertions(+), 24 deletions(-) (limited to 'odoo/tests') diff --git a/odoo/tests/common.py b/odoo/tests/common.py index 71418c5cc2f..066bb067148 100644 --- a/odoo/tests/common.py +++ b/odoo/tests/common.py @@ -1255,14 +1255,8 @@ class HttpCaseCommon(BaseCase): if self.registry_test_mode: self.registry.enter_test_mode(self.cr) self.addCleanup(self.registry.leave_test_mode) - # setup a magic session_id that will be rollbacked - self.session = odoo.http.root.session_store.new() - self.session_id = self.session.sid - self.session.db = get_db_name() - odoo.http.root.session_store.save(self.session) # setup an url opener helper self.opener = requests.Session() - self.opener.cookies['session_id'] = self.session_id @classmethod def start_browser(cls): @@ -1311,31 +1305,44 @@ class HttpCaseCommon(BaseCase): odoo.http.root.session_store.save(self.session) def authenticate(self, user, password): - # stay non-authenticated - if user is None: - if self.session: - odoo.http.root.session_store.delete(self.session) - self.browser.delete_cookie('session_id', domain=HOST) - return - db = get_db_name() - uid = self.registry['res.users'].authenticate(db, user, password, {'interactive': False}) - env = api.Environment(self.cr, uid, {}) - - session = self.session + if getattr(self, 'session', None): + odoo.http.root.session_store.delete(self.session) + self.session = session = odoo.http.root.session_store.new() session.db = db - session.uid = uid - session.login = user - session.session_token = uid and security.compute_session_token(session, env) - session.context = dict(env['res.users'].context_get() or {}) - session.context['uid'] = uid - session._fix_lang(session.context) + + if user: # if authenticated + uid = self.registry['res.users'].authenticate(db, user, password, {'interactive': False}) + env = api.Environment(self.cr, uid, {}) + session.uid = uid + session.login = user + session.session_token = uid and security.compute_session_token(session, env) + session.context = dict(env['res.users'].context_get() or {}) + session.context['uid'] = uid + session._fix_lang(session.context) odoo.http.root.session_store.save(session) + # Reset the opener: turns out when we set cookies['foo'] we're really + # setting a cookie on domain='' path='/'. + # + # But then our friendly neighborhood server might set a cookie for + # domain='localhost' path='/' (with the same value) which is considered + # a *different* cookie following ours rather than the same. + # + # When we update our cookie, it's done in-place, so the server-set + # cookie is still present and (as it follows ours and is more precise) + # very likely to still be used, therefore our session change is ignored. + # + # An alternative would be to set the cookie to None (unsetting it + # completely) or clear-ing session.cookies. + self.opener = requests.Session() + self.opener.cookies['session_id'] = session.sid if self.browser: self._logger.info('Setting session cookie in browser') - self.browser.set_cookie('session_id', self.session_id, '/', HOST) + self.browser.set_cookie('session_id', session.sid, '/', HOST) + + return session def browser_js(self, url_path, code, ready='', login=None, timeout=60, **kw): """ Test js code running in the browser -- cgit v1.2.3