audrius/app-odoo
1
0
Fork 0
mirror of https://github.com/guohuadeng/app-odoo.git synced 2025-02-23 04:11:36 +02:00
Code Issues Packages Projects Releases Wiki Activity

[FIX] app_common, app_odoo_customize: security 13

Browse Source
This commit is contained in:
Chill
2024-03-11 17:27:22 +08:00
parent 0637e4d0c3
commit 7677f839c3
6 changed files with 51 additions and 34 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
app_common/__manifest__.py
View File

@@ -33,7 +33,7 @@
{ {
'name': "odooai Odooapp Common Func", 'name': "odooai Odooapp Common Func",
'version': '13.22.08.21', 'version': '13.24.03.11',
'author': 'odooai.cn', 'author': 'odooai.cn',
'category': 'Base', 'category': 'Base',
'website': 'https://www.odooai.cn', 'website': 'https://www.odooai.cn',

10
app_common/models/base.py
View File

@@ -51,6 +51,12 @@ EXCLU_FIELDS = [
class Base(models.AbstractModel): class Base(models.AbstractModel):
_inherit = 'base' _inherit = 'base'
@api.model
def _app_check_sys_op(self):
if self.env.user.has_group('base.group_erp_manager'):
return True
return False
@api.model @api.model
def _get_normal_fields(self): def _get_normal_fields(self):
f_list = [] f_list = []
@@ -99,7 +105,9 @@ class Base(models.AbstractModel):
return dt.astimezone(pytz_timezone).strftime(return_format) return dt.astimezone(pytz_timezone).strftime(return_format)
@api.model @api.model
def get_image_from_url(self, url): def _get_image_from_url(self, url):
if not self._app_check_sys_op():
return False
if not url: if not url:
return None return None
try: try:

2
app_common/static/description/index.html
View File

@@ -4,7 +4,7 @@
<h2 class="oe_slogan"> </h2> <h2 class="oe_slogan"> </h2>
<h3 class="oe_slogan"> </h3> <h3 class="oe_slogan"> </h3>
<div class="oe_row"> <div class="oe_row">
<h3>Lastest update: v13.20.01.01</h3> <h3>Lastest update: v13.24.03.11</h3>
<div class="row"> <div class="row">
<img class="oe_demo oe_screenshot" style="max-height: 100%;" src="banner.png"> <img class="oe_demo oe_screenshot" style="max-height: 100%;" src="banner.png">
</div> </div>

2
app_odoo_customize/__manifest__.py
View File

@@ -23,7 +23,7 @@
{ {
'name': 'odoo Tweak,Boost,Customize,Ai All in One. Customize,UI,Boost,Security,Data,Development Enhance', 'name': 'odoo Tweak,Boost,Customize,Ai All in One. Customize,UI,Boost,Security,Data,Development Enhance',
'version': '13.23.12.28', 'version': '13.24.03.11',
'author': 'odooai.cn', 'author': 'odooai.cn',
'category': 'Productivity', 'category': 'Productivity',
'website': 'https://www.odooai.cn', 'website': 'https://www.odooai.cn',

67
app_odoo_customize/models/res_config_settings.py
View File

@@ -3,7 +3,7 @@
import logging import logging
from odoo import api, fields, models, _ from odoo import api, fields, models, _
from odoo.exceptions import UserError
_logger = logging.getLogger(__name__) _logger = logging.getLogger(__name__)
@@ -106,14 +106,21 @@ class ResConfigSettings(models.TransientModel):
ir_config.set_param("app_ribbon_name", self.app_ribbon_name or "*odooai.cn") ir_config.set_param("app_ribbon_name", self.app_ribbon_name or "*odooai.cn")
def set_module_url(self): def set_module_url(self):
sql = "UPDATE ir_module_module SET website = '%s' WHERE license like '%s' and website <> ''" % (self.app_enterprise_url, 'OEEL%') if not self._app_check_sys_op():
try: raise UserError(_('Not allow.'))
self._cr.execute(sql) config_parameter = self.env['ir.config_parameter'].sudo()
self._cr.commit() app_enterprise_url = config_parameter.get_param('app_enterprise_url', 'https://www.odooai.cn')
except Exception as e: modules = self.env['ir.module.module'].search([('license', 'like', 'OEEL%'), ('website', '!=', False)])
pass if modules:
sql = "UPDATE ir_module_module SET website = '%s' WHERE id IN %s" % (app_enterprise_url, tuple(modules.ids))
try:
self._cr.execute(sql)
except Exception as e:
pass
def clear_table(self, t_name): def _clear_table(self, t_name):
if not self._app_check_sys_op():
raise UserError(_('Not allow.'))
sql = "delete from %s" % t_name sql = "delete from %s" % t_name
# 增加多公司处理 # 增加多公司处理
try: try:
@@ -125,7 +132,9 @@ class ResConfigSettings(models.TransientModel):
return False return False
# 清数据，o=对象, s=序列 # 清数据，o=对象, s=序列
def remove_app_data(self, o, s=[]): def _remove_app_data(self, o, s=[]):
if not self._app_check_sys_op():
raise UserError(_('Not allow.'))
for line in o: for line in o:
# 检查是否存在 # 检查是否存在
try: try:
@@ -142,7 +151,7 @@ class ResConfigSettings(models.TransientModel):
else: else:
t_name = obj._table t_name = obj._table
# todo: 每个项目具体优化 # todo: 每个项目具体优化
self.clear_table(t_name) self._clear_table(t_name)
# 更新序号 # 更新序号
for line in s: for line in s:
@@ -173,7 +182,7 @@ class ResConfigSettings(models.TransientModel):
seqs = [ seqs = [
'sale', 'sale',
] ]
return self.remove_app_data(to_removes, seqs) return self._remove_app_data(to_removes, seqs)
def remove_product(self): def remove_product(self):
to_removes = [ to_removes = [
@@ -184,7 +193,7 @@ class ResConfigSettings(models.TransientModel):
seqs = [ seqs = [
'product.product', 'product.product',
] ]
return self.remove_app_data(to_removes, seqs) return self._remove_app_data(to_removes, seqs)
def remove_product_attribute(self): def remove_product_attribute(self):
to_removes = [ to_removes = [
@@ -193,7 +202,7 @@ class ResConfigSettings(models.TransientModel):
'product.attribute', 'product.attribute',
] ]
seqs = [] seqs = []
return self.remove_app_data(to_removes, seqs) return self._remove_app_data(to_removes, seqs)
def remove_pos(self): def remove_pos(self):
to_removes = [ to_removes = [
@@ -206,12 +215,12 @@ class ResConfigSettings(models.TransientModel):
seqs = [ seqs = [
'pos.', 'pos.',
] ]
res = self.remove_app_data(to_removes, seqs) res = self._remove_app_data(to_removes, seqs)
# 更新要关帐的值，因为 store=true 的计算字段要重置 # 更新要关帐的值，因为 store=true 的计算字段要重置
try: try:
statement = self.env['account.bank.statement'].sudo().search([]) statement = self.env['account.bank.statement'].search([])
for s in statement: for s in statement:
s._end_balance() s._end_balance()
except Exception as e: except Exception as e:
@@ -229,7 +238,7 @@ class ResConfigSettings(models.TransientModel):
seqs = [ seqs = [
'purchase.', 'purchase.',
] ]
return self.remove_app_data(to_removes, seqs) return self._remove_app_data(to_removes, seqs)
def remove_expense(self): def remove_expense(self):
to_removes = [ to_removes = [
@@ -242,7 +251,7 @@ class ResConfigSettings(models.TransientModel):
seqs = [ seqs = [
'hr.expense.', 'hr.expense.',
] ]
return self.remove_app_data(to_removes, seqs) return self._remove_app_data(to_removes, seqs)
def remove_mrp(self): def remove_mrp(self):
to_removes = [ to_removes = [
@@ -260,7 +269,7 @@ class ResConfigSettings(models.TransientModel):
seqs = [ seqs = [
'mrp.', 'mrp.',
] ]
return self.remove_app_data(to_removes, seqs) return self._remove_app_data(to_removes, seqs)
def remove_mrp_bom(self): def remove_mrp_bom(self):
to_removes = [ to_removes = [
@@ -269,7 +278,7 @@ class ResConfigSettings(models.TransientModel):
'mrp.bom', 'mrp.bom',
] ]
seqs = [] seqs = []
return self.remove_app_data(to_removes, seqs) return self._remove_app_data(to_removes, seqs)
def remove_inventory(self): def remove_inventory(self):
to_removes = [ to_removes = [
@@ -298,7 +307,7 @@ class ResConfigSettings(models.TransientModel):
'product.tracking.default', 'product.tracking.default',
'WH/', 'WH/',
] ]
return self.remove_app_data(to_removes, seqs) return self._remove_app_data(to_removes, seqs)
def remove_account(self): def remove_account(self):
to_removes = [ to_removes = [
@@ -315,7 +324,7 @@ class ResConfigSettings(models.TransientModel):
'account.reconcile.model.template', 'account.reconcile.model.template',
'account.reconcile.model', 'account.reconcile.model',
] ]
res = self.remove_app_data(to_removes, []) res = self._remove_app_data(to_removes, [])
# extra 更新序号 # extra 更新序号
domain = [ domain = [
@@ -426,9 +435,9 @@ class ResConfigSettings(models.TransientModel):
pass # raise Warning(e) pass # raise Warning(e)
seqs = [] seqs = []
res = self.remove_app_data(to_removes, seqs) res = self._remove_app_data(to_removes, seqs)
self._cr.commit() self._cr.commit()
self.env.company.sudo().write({'chart_template_id': None}) self.env.company.write({'chart_template_id': None})
return res return res
def remove_project(self): def remove_project(self):
@@ -440,7 +449,7 @@ class ResConfigSettings(models.TransientModel):
'project.project', 'project.project',
] ]
seqs = [] seqs = []
return self.remove_app_data(to_removes, seqs) return self._remove_app_data(to_removes, seqs)
def remove_quality(self): def remove_quality(self):
to_removes = [ to_removes = [
@@ -459,7 +468,7 @@ class ResConfigSettings(models.TransientModel):
'quality.alert', 'quality.alert',
# 'quality.point', # 'quality.point',
] ]
return self.remove_app_data(to_removes, seqs) return self._remove_app_data(to_removes, seqs)
def remove_quality_setting(self): def remove_quality_setting(self):
to_removes = [ to_removes = [
@@ -471,7 +480,7 @@ class ResConfigSettings(models.TransientModel):
'quality.reason', 'quality.reason',
'quality.tag', 'quality.tag',
] ]
return self.remove_app_data(to_removes) return self._remove_app_data(to_removes)
def remove_website(self): def remove_website(self):
to_removes = [ to_removes = [
@@ -492,7 +501,7 @@ class ResConfigSettings(models.TransientModel):
# 'website', # 'website',
] ]
seqs = [] seqs = []
return self.remove_app_data(to_removes, seqs) return self._remove_app_data(to_removes, seqs)
def remove_message(self): def remove_message(self):
to_removes = [ to_removes = [
@@ -504,7 +513,7 @@ class ResConfigSettings(models.TransientModel):
'bus.bus', 'bus.bus',
] ]
seqs = [] seqs = []
return self.remove_app_data(to_removes, seqs) return self._remove_app_data(to_removes, seqs)
def remove_workflow(self): def remove_workflow(self):
to_removes = [ to_removes = [
@@ -513,7 +522,7 @@ class ResConfigSettings(models.TransientModel):
'wkf.instance', 'wkf.instance',
] ]
seqs = [] seqs = []
return self.remove_app_data(to_removes, seqs) return self._remove_app_data(to_removes, seqs)
def remove_all_biz(self): def remove_all_biz(self):
self.remove_account() self.remove_account()

2
app_odoo_customize/static/description/index.html
View File

@@ -20,7 +20,7 @@
<section class="container app"> <section class="container app">
<div class="oe_row oe_spaced" style="max-width: 95%;"> <div class="oe_row oe_spaced" style="max-width: 95%;">
<div class="row"> <div class="row">
<h2 class="oe_slogan">This is a Long Term Support Apps.Update: v16.5.23.09.30</h2> <h2 class="oe_slogan">This is a Long Term Support Apps.Update: v13.24.03.11</h2>
<div class="oe_demo" style=" margin: 30px auto 0; padding: 0 15px 0 0; border:none; width: 96%;"> <div class="oe_demo" style=" margin: 30px auto 0; padding: 0 15px 0 0; border:none; width: 96%;">
<ul class="list-group"> <ul class="list-group">
<li class="list-group-item">1. Deletes Odoo label in footer</li> <li class="list-group-item">1. Deletes Odoo label in footer</li>