changeset 340454839b57 in trytond:default
details: https://hg.tryton.org/trytond?cmd=changeset;node=340454839b57
description:
Add route wrapper to allow null origin
Webextensions may use 'null' as Origin if the browser considers that the
request is not trustworthy. To keep such webextensions working, we need
to
allow such requests for that we add an attribute on the endpoint.
issue10058
review331931002
diffstat:
CHANGELOG | 1 +
doc/topics/user_application.rst | 3 +++
trytond/protocols/wrappers.py | 5 +++++
trytond/res/routes.py | 4 +++-
trytond/wsgi.py | 7 ++++++-
5 files changed, 18 insertions(+), 2 deletions(-)
diffs (77 lines):
diff -r b6d3c7238166 -r 340454839b57 CHANGELOG
--- a/CHANGELOG Sat Mar 06 19:12:49 2021 +0100
+++ b/CHANGELOG Sun Mar 07 10:01:20 2021 +0100
@@ -1,3 +1,4 @@
+* Add route wrapper to allow null origin
* Add header grouping on report
* Protect trusted devices against brute force attack
* Make ModelView.parse_view public
diff -r b6d3c7238166 -r 340454839b57 doc/topics/user_application.rst
--- a/doc/topics/user_application.rst Sat Mar 06 19:12:49 2021 +0100
+++ b/doc/topics/user_application.rst Sun Mar 07 10:01:20 2021 +0100
@@ -35,6 +35,9 @@
- ``set_max_request_size(size)``: change the default limit of the request
to
the size in bytes.
+ - ``allow_null_origin``: allow requests which have their ``Origin`` set to
+ ``null``.
+
- ``with_pool``: which takes the first parameter as database name and
replace it by the corresponding instance of the :ref:`Pool <ref-pool>`.
diff -r b6d3c7238166 -r 340454839b57 trytond/protocols/wrappers.py
--- a/trytond/protocols/wrappers.py Sat Mar 06 19:12:49 2021 +0100
+++ b/trytond/protocols/wrappers.py Sun Mar 07 10:01:20 2021 +0100
@@ -120,6 +120,11 @@
return decorator
+def allow_null_origin(func):
+ func.allow_null_origin = True
+ return func
+
+
def with_pool(func):
@wraps(func)
def wrapper(request, database_name, *args, **kwargs):
diff -r b6d3c7238166 -r 340454839b57 trytond/res/routes.py
--- a/trytond/res/routes.py Sat Mar 06 19:12:49 2021 +0100
+++ b/trytond/res/routes.py Sun Mar 07 10:01:20 2021 +0100
@@ -8,13 +8,15 @@
from trytond.config import config
from trytond.wsgi import app
-from trytond.protocols.wrappers import with_pool, with_transaction
+from trytond.protocols.wrappers import (
+ with_pool, with_transaction, allow_null_origin)
from trytond.transaction import Transaction
logger = logging.getLogger(__name__)
@app.route('/<database_name>/user/application/', methods=['POST', 'DELETE'])
+@allow_null_origin
@with_pool
@with_transaction(readonly=False)
def user_application(request, pool):
diff -r b6d3c7238166 -r 340454839b57 trytond/wsgi.py
--- a/trytond/wsgi.py Sat Mar 06 19:12:49 2021 +0100
+++ b/trytond/wsgi.py Sun Mar 07 10:01:20 2021 +0100
@@ -167,11 +167,16 @@
origin = request.headers.get('Origin')
origin_host = urllib.parse.urlparse(origin).netloc if origin else ''
host = request.headers.get('Host')
- if origin and origin_host != host:
+ if origin and origin != 'null' and origin_host != host:
cors = filter(
None, config.get('web', 'cors', default='').splitlines())
if origin not in cors:
abort(HTTPStatus.FORBIDDEN)
+ if origin == 'null':
+ adapter = self.url_map.bind_to_environ(request.environ)
+ endpoint = adapter.match()[0]
+ if not getattr(endpoint, 'allow_null_origin', False):
+ abort(HTTPStatus.FORBIDDEN)
data = self.dispatch_request(request)
if not isinstance(data, (Response, HTTPException)):
