use_control module doesn't check if module is installed

Bug #622607 reported by Albert Cervera i Areny - http://www.NaN-tic.com
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Odoo Addons (MOVED TO GITHUB)
Fix Released
Undecided
Unassigned

Bug Description

use_control module overrides the security.check function with the following code:

--------------------------------------

def check(chk_fnct):
    data = {}
    def check_one(db, uid, passwd):
        data.setdefault(db, {})
        cr = pooler.get_db(db).cursor()
        try:
            # Check if the database is blocked
            cr.execute('SELECT name FROM use_control_db_block')
            msg = cr.fetchone()
            if msg:
                # raise an Exception formatted for the client
                # netsvc.Service.abortResponse can't be called while it's not a static method...
                raise Exception('warning -- %s\n\n%s' % ('Database blocked', msg[0]))

            if (uid not in data) or (data[uid] < time.time()):
                data[uid] = time.time() + 3600 * HOUR_MINI
                try:
                    cr.execute('insert into use_control_time (user_id, date, duration) values (%s,%s,%s)',
                                (int(uid), time.strftime('%Y-%m-%d %H:%M:%S'), HOUR_MINI))
                    cr.commit()
                except:
                    pass
        finally:
            cr.close()
        return chk_fnct(db, uid, passwd)
    return check_one

# May be it's better using inheritancy and resubscribing the service
# Override the check method to store use of the database
from service import security
security.check = check(security.check)

--------------------------------------

The problem is that the new "def check" function does not check if use_control_db_block table exists. The table may not exist if the user is using two databases in the same server, and in one of the the module is installed and the other one it isn't.

So the function, once it has the pool/cursor, should search the database and see if the module is installed.

Revision history for this message
Christophe Simonis (OpenERP) (kangol) wrote :

fixed by 13 <email address hidden>

Changed in openobject-addons:
status: New → Fix Released
Revision history for this message
Christophe Simonis (OpenERP) (kangol) wrote :

by the way use_control have been deleted from extra-addons/5.0 as it now live in another branch

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.