From 045b9019ef70d3fa2df0acb6ea3fd112c06bf7bb Mon Sep 17 00:00:00 2001
From: Xavier Morel <xmo@odoo.com>
Date: Mon, 9 Nov 2015 14:17:51 +0530
Subject: [FIX] base_import_module: CSRF handling

* disabled CSRF protection for login route
* return CSRF token from login and retransmit it during module upload

``deploy`` only sends CSRF token if given one by authenticate so that
the command can be used for non-updated modules.

Closes #9488
---
 openerp/cli/deploy.py | 21 +++++++++++++--------
 1 file changed, 13 insertions(+), 8 deletions(-)

(limited to 'openerp/cli/deploy.py')

diff --git a/openerp/cli/deploy.py b/openerp/cli/deploy.py
index 7c5e9536c0c..2e97d838ec2 100644
--- a/openerp/cli/deploy.py
+++ b/openerp/cli/deploy.py
@@ -17,21 +17,24 @@ class Deploy(Command):
 
     def deploy_module(self, module_path, url, login, password, db='', force=False):
         url = url.rstrip('/')
-        self.authenticate(url, login, password, db)
+        csrf_token = self.authenticate(url, login, password, db)
         module_file = self.zip_module(module_path)
         try:
-            return self.upload_module(url, module_file, force=force)
+            return self.upload_module(url, module_file, force=force, csrf_token=csrf_token)
         finally:
             os.remove(module_file)
 
-    def upload_module(self, server, module_file, force=False):
+    def upload_module(self, server, module_file, force=False, csrf_token=None):
         print("Uploading module file...")
         url = server + '/base_import_module/upload'
-        files = dict(mod_file=open(module_file, 'rb'))
-        force = '1' if force else ''
-        res = self.session.post(url, files=files, data=dict(force=force))
-        if res.status_code != 200:
-            raise Exception("Could not authenticate on server '%s'" % server)
+
+        post_data = {'force': '1' if force else ''}
+        if csrf_token: post_data['csrf_token'] = csrf_token
+
+        with open(module_file, 'rb') as f:
+            res = self.session.post(url, files={'mod_file': f}, data=post_data)
+        res.raise_for_status()
+
         return res.text
 
     def authenticate(self, server, login, password, db=''):
@@ -47,6 +50,8 @@ class Deploy(Command):
         elif res.status_code != 200:
             raise Exception(res.text)
 
+        return res.headers.get('x-csrf-token')
+
     def zip_module(self, path):
         path = os.path.abspath(path)
         if not os.path.isdir(path):
-- 
cgit v1.2.3