mirror of
https://gitlab.com/hibou-io/hibou-odoo/suite.git
synced 2025-01-20 12:37:31 +02:00
64ee02a10c
Additionally, allowing the field to be written to improves the UI by automatically highlighting it and doesn't really have any negative side effects. (how could you alter the hmac?)
94 lines
2.9 KiB
Python
Executable File
94 lines
2.9 KiB
Python
Executable File
from odoo import models, api, exceptions
|
|
from odoo.http import request
|
|
from datetime import datetime
|
|
from time import mktime
|
|
import hmac
|
|
from hashlib import sha256
|
|
|
|
from logging import getLogger
|
|
_logger = getLogger(__name__)
|
|
|
|
|
|
def admin_auth_generate_login(env, user):
|
|
"""
|
|
Generates a URL to allow the current user to login as the portal user.
|
|
|
|
:param env: Odoo environment
|
|
:param user: `res.users` in
|
|
:return:
|
|
"""
|
|
if not env['res.partner'].check_access_rights('write'):
|
|
return None
|
|
u = str(user.id)
|
|
now = datetime.utcnow()
|
|
fifteen = int(mktime(now.timetuple())) + (15 * 60)
|
|
e = str(fifteen)
|
|
o = str(env.uid)
|
|
|
|
config = env['ir.config_parameter'].sudo()
|
|
key = str(config.search([('key', '=', 'database.secret')], limit=1).value)
|
|
h = hmac.new(key.encode(), (u + e + o).encode(), sha256)
|
|
|
|
base_url = str(config.search([('key', '=', 'web.base.url')], limit=1).value)
|
|
|
|
_logger.warn('login url for user id: ' + u + ' original user id: ' + o)
|
|
|
|
return base_url + '/auth_admin?u=' + u + '&e=' + e + '&o=' + o + '&h=' + h.hexdigest()
|
|
|
|
|
|
def check_admin_auth_login(env, u_user_id, e_expires, o_org_user_id, hash_):
|
|
"""
|
|
Checks that the parameters are valid and that the user exists.
|
|
|
|
:param env: Odoo environment
|
|
:param u_user_id: Desired user id to login as.
|
|
:param e_expires: Expiration timestamp
|
|
:param o_org_user_id: Original user id.
|
|
:param hash_: HMAC generated hash
|
|
:return: `res.users`
|
|
"""
|
|
|
|
now = datetime.utcnow()
|
|
now = int(mktime(now.timetuple()))
|
|
fifteen = now + (15 * 60)
|
|
|
|
config = env['ir.config_parameter'].sudo()
|
|
key = str(config.search([('key', '=', 'database.secret')], limit=1).value)
|
|
|
|
myh = hmac.new(key.encode(), str(str(u_user_id) + str(e_expires) + str(o_org_user_id)).encode(), sha256)
|
|
|
|
if not hmac.compare_digest(hash_, myh.hexdigest()):
|
|
raise exceptions.AccessDenied('Invalid Request')
|
|
|
|
if not (now <= int(e_expires) <= fifteen):
|
|
raise exceptions.AccessDenied('Expired')
|
|
|
|
user = env['res.users'].sudo().search([('id', '=', int(u_user_id))], limit=1)
|
|
if not user.id:
|
|
raise exceptions.AccessDenied('Invalid User')
|
|
return user
|
|
|
|
|
|
class ResUsers(models.Model):
|
|
_inherit = 'res.users'
|
|
|
|
@api.multi
|
|
def admin_auth_generate_login(self):
|
|
self.ensure_one()
|
|
|
|
login_url = admin_auth_generate_login(self.env, self)
|
|
if login_url:
|
|
raise exceptions.Warning(login_url)
|
|
|
|
return False
|
|
|
|
def _check_credentials(self, password):
|
|
try:
|
|
return super(ResUsers, self)._check_credentials(password)
|
|
except exceptions.AccessDenied:
|
|
if request and hasattr(request, 'session') and request.session.get('auth_admin'):
|
|
_logger.warn('_check_credentials for user id: ' + \
|
|
str(request.session.uid) + ' original user id: ' + str(request.session.auth_admin))
|
|
else:
|
|
raise
|