[FIX] app_common: security

app_common/__manifest__.py

@@ -39,7 +39,7 @@
 
 {
     'name': "odooAi Common Util and Tools",
-    'version': '23.11.16',
+    'version': '24.03.11',
     'author': 'odooai.cn',
     'category': 'Base',
     'website': 'https://www.odooai.cn',

app_common/models/base.py

@@ -53,6 +53,12 @@ EXCLU_FIELDS = [
 class Base(models.AbstractModel):
     _inherit = 'base'
     
+    @api.model
+    def _app_check_sys_op(self):
+        if self.env.user.has_group('base.group_erp_manager'):
+            return True
+        return False
+
     @api.model
     def _get_normal_fields(self):
         f_list = []
@@ -101,32 +107,50 @@ class Base(models.AbstractModel):
         return dt.astimezone(pytz_timezone).strftime(return_format)
 
     @api.model
-    def get_image_from_url(self, url):
+    def _get_image_from_url(self, url):
         # 返回这个图片的base64编码
+        if not self._app_check_sys_op():
+            return False
         return get_image_from_url(url)
 
     @api.model
-    def get_image_url2attachment(self, url, mimetype_list=None):
+    def _get_image_url2attachment(self, url, mimetype_list=None):
         # Todo: mimetype filter
+        if not self._app_check_sys_op():
+            return False
         image, file_name = get_image_url2attachment(url)
         if image and file_name:
+            try:
                 attachment = self.env['ir.attachment'].create({
                     'datas': image,
                     'name': file_name,
+                    'website_id': False,
                 })
+                attachment.generate_access_token()
                 return attachment
+            except Exception as e:
+                _logger.error('get_image_url2attachment error: %s' % str(e))
+                return False
         else:
             return False
 
     @api.model
-    def get_image_base642attachment(self, data):
+    def _get_image_base642attachment(self, data):
+        if not self._app_check_sys_op():
+            return False
         image, file_name = get_image_base642attachment(data)
         if image and file_name:
+            try:
                 attachment = self.env['ir.attachment'].create({
                     'datas': image,
                     'name': file_name,
+                    'website_id': False,
                 })
+                attachment.generate_access_token()
                 return attachment
+            except Exception as e:
+                _logger.error('get_image_base642attachment error: %s' % str(e))
+                return False
         else:
             return False
 

app_common/static/description/index.html

@@ -4,7 +4,7 @@
             <h2 class="oe_slogan">odooAi Common Util and Tools</h2>
             <h3 class="oe_slogan"> Network and media and base tools </h3>
             <div class="oe_row">
-                <h3>Lastest update: v17.23.11.06</h3>
+                <h3>Lastest update: v17.24.03.11</h3>
                 <div class="row">
                     <img class="oe_demo  oe_screenshot img img-fluid"  style="max-height: 100%;" src="banner.png">
                 </div>