From 5b2852e44286719be48483cc253539d8446b3667 Mon Sep 17 00:00:00 2001 From: Christophe Chauvet Date: Mon, 7 Dec 2009 11:37:06 +0100 Subject: [PATCH 01/23] [IMP] Disallow connection to PostgreSQL with postgres user himself (security flaws) bzr revid: christophe.chauvet@syleam.fr-20091207103706-vp3sc1gydbjtqmzg --- bin/openerp-server.py | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/bin/openerp-server.py b/bin/openerp-server.py index 33b5fef9aeb..2d445070011 100755 --- a/bin/openerp-server.py +++ b/bin/openerp-server.py @@ -70,6 +70,12 @@ logger = netsvc.Logger() #----------------------------------------------------------------------- import tools +# Check if the connection to PostgreSQL don't use postgres user +if tools.config['db_user'] == 'postgres': + sys.stderr.write("Attempted to connected database with postgres user." \ + " This is a security flaws, aborting.\n") + sys.exit(1) + logger.notifyChannel("server", netsvc.LOG_INFO, "version - %s" % release.version ) for name, value in [('addons_path', tools.config['addons_path']), ('database hostname', tools.config['db_host'] or 'localhost'), From 3925b8388fd173219470b86e5d97562d33a8e132 Mon Sep 17 00:00:00 2001 From: Fabien Pinckaers Date: Tue, 9 Mar 2010 09:44:22 +0100 Subject: [PATCH 02/23] [IMP] removed tests in base bzr revid: fp@tinyerp.com-20100309084422-83zbkvap5smz9o7y --- bin/addons/base/res/partner/partner_view.xml | 37 ++------------------ 1 file changed, 2 insertions(+), 35 deletions(-) diff --git a/bin/addons/base/res/partner/partner_view.xml b/bin/addons/base/res/partner/partner_view.xml index 6d8e6b00b19..938ffc83d12 100644 --- a/bin/addons/base/res/partner/partner_view.xml +++ b/bin/addons/base/res/partner/partner_view.xml @@ -252,43 +252,10 @@ form
- -
- HTML Form Example -
- - - - - -
- - - - - - -
- - OpenERP - - - - Tiny - -
-
-
- - + + From 231336c878cef4cd3b8054cbea8ce187c2bf470f Mon Sep 17 00:00:00 2001 From: Julien Thewys Date: Mon, 8 Mar 2010 23:51:58 +0100 Subject: [PATCH 03/23] [FIX] Added TEST logging level to the command line options. bzr revid: jth@openerp.com-20100308225158-wkbgit6epxt3ggga --- bin/tools/config.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/bin/tools/config.py b/bin/tools/config.py index 23a1666b6c6..bc4aa98b77e 100644 --- a/bin/tools/config.py +++ b/bin/tools/config.py @@ -89,7 +89,7 @@ class configmanager(object): hasSSL = check_ssl() self._LOGLEVELS = dict([(getattr(netsvc, 'LOG_%s' % x), getattr(logging, x)) - for x in ('CRITICAL', 'ERROR', 'WARNING', 'INFO', 'DEBUG', 'DEBUG_RPC', 'NOTSET')]) + for x in ('CRITICAL', 'ERROR', 'WARNING', 'INFO', 'TEST', 'DEBUG', 'DEBUG_RPC', 'NOTSET')]) version = "%s %s" % (release.description, release.version) parser = optparse.OptionParser(version=version) From f6cb964437fb0c5b9eb6bfa959caeaa503f38cf2 Mon Sep 17 00:00:00 2001 From: Julien Thewys Date: Tue, 9 Mar 2010 10:23:46 +0100 Subject: [PATCH 04/23] [IMP] Cleanup. bzr revid: jth@openerp.com-20100309092346-ehfpe1fhe26a1u0a --- bin/tools/yaml_import.py | 96 ++++++++++++++++++++++++++-------------- 1 file changed, 63 insertions(+), 33 deletions(-) diff --git a/bin/tools/yaml_import.py b/bin/tools/yaml_import.py index 8296a205830..7ebc1a39f70 100644 --- a/bin/tools/yaml_import.py +++ b/bin/tools/yaml_import.py @@ -19,8 +19,9 @@ class YamlImportAbortion(Exception): pass class YamlTag(object): - """Superclass for constructors of custom tags defined in yaml file.""" - + """ + Superclass for constructors of custom tags defined in yaml file. + """ def __init__(self, **kwargs): self.__dict__.update(kwargs) def __getitem__(self, key): @@ -45,7 +46,7 @@ class Record(YamlTag): super(Record, self).__init__(**kwargs) class Python(YamlTag): - def __init__(self, model, severity=logging.ERROR, name="NONAME", **kwargs): + def __init__(self, model, severity=logging.ERROR, name="", **kwargs): self.model= model self.severity = severity self.name = name @@ -228,9 +229,10 @@ class TestReport(object): self._report = {} def record(self, success, severity): - """Records the result of an assertion for the failed/success count. - Returns success.""" - + """ + Records the result of an assertion for the failed/success count. + Returns success. + """ if severity in self._report: self._report[severity][success] += 1 else: @@ -249,7 +251,18 @@ class TestReport(object): res.append("end of report (%s assertion(s) checked)" % success + failure) return "\n".join(res) - +class RecordDictWrapper(dict): + """ + Used to pass a record as locals in eval: + records do not strictly behave like dict, so we force them to. + """ + def __init__(self, record): + self.record = record + def __getitem__(self, key): + if key in self.record: + return self.record[key] + return dict.__getitem__(self, key) + class YamlInterpreter(object): def __init__(self, cr, module, id_map, mode, filename, noupdate=False): self.cr = cr @@ -259,10 +272,11 @@ class YamlInterpreter(object): self.filename = filename self.assert_report = TestReport() self.noupdate = noupdate - self.logger = logging.getLogger(logger_channel) + self.logger = logging.getLogger("%s.%s" % (logger_channel, self.module)) self.pool = pooler.get_pool(cr.dbname) self.uid = 1 - self.context = {} + self.context = {} # opererp context + self.eval_context = {'ref': self._ref, '_ref': self._ref} # added '_ref' so that record['ref'] is possible def _ref(self): return lambda xml_id: self.get_id(xml_id) @@ -282,11 +296,13 @@ class YamlInterpreter(object): if module != self.module: module_count = self.pool.get('ir.module.module').search_count(self.cr, self.uid, \ ['&', ('name', '=', module), ('state', 'in', ['installed'])]) - assert module_count == 1, """The ID "%s" refers to an uninstalled module""" % (xml_id,) + assert module_count == 1, 'The ID "%s" refers to an uninstalled module.' % (xml_id,) if len(id) > 64: # TODO where does 64 come from (DB is 128)? should be a constant or loaded form DB self.logger.log(logging.ERROR, 'id: %s is to long (max: 64)', id) def get_id(self, xml_id): + if not xml_id: + raise YamlImportException("The xml_id should be a non empty string.") if isinstance(xml_id, types.IntType): id = xml_id elif xml_id in self.id_map: @@ -302,10 +318,10 @@ class YamlInterpreter(object): self.id_map[xml_id] = id return id - def get_context(self, node, locals_dict): + def get_context(self, node, eval_dict): context = self.context.copy() if node.context: - context.update(eval(node.context, locals_dict)) + context.update(eval(node.context, eval_dict)) return context def isnoupdate(self, node): @@ -318,14 +334,14 @@ class YamlInterpreter(object): self.assert_report.record(False, severity) self.logger.log(severity, msg, *args) if severity >= config['assert_exit_level']: - raise YamlImportAbortion('Severe assertion failure (%s), aborting.' % (severity,)) + raise YamlImportAbortion('Severe assertion failure (%s), aborting.' % logging.getLevelName(severity)) return def _get_assertion_id(self, assertion): if assertion.id: ids = [self.get_id(assertion.id)] elif assertion.search: - q = eval(assertion.search, {'ref': self._ref}) + q = eval(assertion.search, self.eval_context) ids = self.pool.get(assertion.model).search(self.cr, self.uid, q, context=assertion.context) if not ids: raise YamlImportException('Nothing to assert: you must give either an id or a search criteria.') @@ -346,12 +362,14 @@ class YamlInterpreter(object): args = (assertion.string, assertion.count, len(ids)) self._log_assert_failure(assertion.severity, msg, *args) else: - local_context = {'ref': self._ref, '_ref': self._ref} # added '_ref' so that record['ref'] is possible - context = self.get_context(assertion, local_context) + context = self.get_context(assertion, self.eval_context) for id in ids: record = model.browse(self.cr, self.uid, id, context) for test in expressions.get('test', ''): - success = eval(test, local_context, record) + try: + success = eval(test, self.eval_context, RecordDictWrapper(record)) + except Exception, e: + raise YamlImportAbortion(e) if not success: msg = 'Assertion "%s" FAILED\ntest: %s\n' args = (assertion.string, test) @@ -367,6 +385,7 @@ class YamlInterpreter(object): if self.isnoupdate(record) and self.mode != 'init': model = self.get_model(record.model) record_dict = self._create_record(model, fields) + self.logger.debug("RECORD_DICT %s" % record_dict) id = self.pool.get('ir.model.data')._update(self.cr, self.uid, record.model, \ self.module, record_dict, record.id, noupdate=self.isnoupdate(record), mode=self.mode) self.id_map[record.id] = int(id) @@ -412,9 +431,9 @@ class YamlInterpreter(object): code_context = {'self': model, 'cr': self.cr, 'uid': self.uid, 'log': log, 'context': self.context} try: code = compile(statements, self.filename, 'exec') - eval(code, code_context) + eval(code, {'ref': self.get_id}, code_context) except AssertionError, e: - self._log_assert_failure(python.severity, 'Assertion "%s" FAILED in Python code.', python.name) + self._log_assert_failure(python.severity, 'AssertionError in Python code %s: %s', python.name, e) return except Exception, e: raise YamlImportAbortion(e) @@ -437,10 +456,9 @@ class YamlInterpreter(object): if not 'model' in value and (not 'eval' in value or not 'search' in value): raise YamlImportException('You must provide a "model" and an "eval" or "search" to evaluate.') value_model = self.get_model(value['model']) - local_context = {'ref': self._ref, '_ref': self._ref} - local_context['obj'] = lambda x: value_model.browse(self.cr, self.uid, x, context=self.context) + local_context = {'obj': lambda x: value_model.browse(self.cr, self.uid, x, context=self.context)} local_context.update(self.id_map) - id = eval(value['eval'], local_context) + id = eval(value['eval'], self.eval_context, local_context) if workflow.uid is not None: uid = workflow.uid @@ -453,19 +471,17 @@ class YamlInterpreter(object): function, values = node.items()[0] if self.isnoupdate(function) and self.mode != 'init': return - local_context = {'ref': self._ref, '_ref': self._ref} - context = self.get_context(function, local_context) + context = self.get_context(function, self.eval_context) args = [] if function.eval: - args = eval(function.eval, local_context) + args = eval(function.eval, self.eval_context) for value in values: if not 'model' in value and (not 'eval' in value or not 'search' in value): raise YamlImportException('You must provide a "model" and an "eval" or "search" to evaluate.') value_model = self.get_model(value['model']) - local_context = {'ref': self._ref, '_ref': self._ref} - local_context['obj'] = lambda x: value_model.browse(self.cr, self.uid, x, context=context) + local_context = {'obj': lambda x: value_model.browse(self.cr, self.uid, x, context=context)} local_context.update(self.id_map) - id = eval(value['eval'], local_context) + id = eval(value['eval'], self.eval_context, local_context) if id != None: args.append(id) model = self.get_model(function.model) @@ -572,7 +588,7 @@ class YamlInterpreter(object): view_id = False if node.view: view_id = self.get_id(node.view) - context = eval(node.context, {'ref': self._ref, '_ref': self._ref}) + context = eval(node.context, self.eval_context) values = { 'name': node.name, @@ -608,7 +624,7 @@ class YamlInterpreter(object): def process_delete(self, node): ids = [] if len(node.search): - ids = self.pool.get(node.model).search(self.cr, self.uid, eval(node.search)) + ids = self.pool.get(node.model).search(self.cr, self.uid, eval(node.search, self.eval_context)) if len(node.id): try: ids.append(self.get_id(node.id)) @@ -642,7 +658,7 @@ class YamlInterpreter(object): res = {} for fieldname, expression in fields.items(): if isinstance(expression, Eval): - value = eval(expression.expression, {'ref': self._ref, '_ref': self._ref}) + value = eval(expression.expression, self.eval_context) else: value = expression res[fieldname] = value @@ -681,10 +697,18 @@ class YamlInterpreter(object): replace = node.replace or True self.pool.get('ir.model.data').ir_set(self.cr, self.uid, 'action', \ keyword, values['name'], [values['model']], value, replace=replace, isobject=True, xml_id=xml_id) + + def process_none(self): + """ + Empty node or commented node should not pass silently. + """ + self._log_assert_failure(logging.WARNING, "You have an empty block in your tests.") + def process(self, yaml_string): - """Processes a Yaml string. Custom tags are interpreted by 'process_' instance methods.""" - + """ + Processes a Yaml string. Custom tags are interpreted by 'process_' instance methods. + """ is_preceded_by_comment = False for node in yaml.load(yaml_string): is_preceded_by_comment = self._log(node, is_preceded_by_comment) @@ -694,7 +718,11 @@ class YamlInterpreter(object): self.logger.log(logging.ERROR, e) except YamlImportAbortion, e: self.logger.log(logging.ERROR, e) + self.cr.rollback() return + except Exception, e: + self.cr.rollback() + raise e def _process_node(self, node): if is_comment(node): @@ -729,6 +757,8 @@ class YamlInterpreter(object): self.process_function(node) else: self.process_function({node: []}) + elif node is None: + self.process_none() else: raise YamlImportException("Can not process YAML block: %s" % node) From 0129ecbcf76f5a2076ddf9278fda4e23b70b175e Mon Sep 17 00:00:00 2001 From: Fabien Pinckaers Date: Tue, 9 Mar 2010 10:56:19 +0100 Subject: [PATCH 05/23] [IMP] project issue form bzr revid: fp@tinyerp.com-20100309095619-r2d676mg94jhsc1u --- addons/crm/crm.py | 3 +- addons/project_issue/project_issue.py | 28 +-- addons/project_issue/project_issue_view.xml | 188 +++++++++----------- 3 files changed, 98 insertions(+), 121 deletions(-) diff --git a/addons/crm/crm.py b/addons/crm/crm.py index 8bc6f56117d..ce318aeca4f 100644 --- a/addons/crm/crm.py +++ b/addons/crm/crm.py @@ -224,6 +224,7 @@ class crm_case(osv.osv): 'email_from': fields.char('Email', size=128, help="These people will receive email."), 'email_cc': fields.text('Watchers Emails', size=252 , help="These people will receive a copy of the future" \ " communication between partner and users by email"), + 'probability': fields.float('Probability'), 'email_last': fields.function(_email_last, method=True, string='Latest E-Mail', type='text'), 'partner_id': fields.many2one('res.partner', 'Partner'), @@ -318,7 +319,7 @@ class crm_case(osv.osv): if section in s: st = case.stage_id.id or False s[section] = dict([(v, k) for (k, v) in s[section].iteritems()]) - if st in s[section]: + if st and st in s[section]: stage_value = self.pool.get('crm.case.stage').read(cr, uid,s[section][st] ,['probability'], context) self.write(cr, uid, [case.id], {'stage_id': s[section][st],'probability':stage_value['probability']}) return True diff --git a/addons/project_issue/project_issue.py b/addons/project_issue/project_issue.py index f0441c0263c..48492f44675 100644 --- a/addons/project_issue/project_issue.py +++ b/addons/project_issue/project_issue.py @@ -29,10 +29,8 @@ from tools.translate import _ import tools from osv import fields,osv,orm from osv.orm import except_orm - from crm import crm - class project_issue(osv.osv): _name = "project.issue" _description = "Project Issue" @@ -45,30 +43,22 @@ class project_issue(osv.osv): 'ref2' : fields.reference('Reference 2', selection=crm._links_get, size=128), 'canal_id': fields.many2one('res.partner.canal', 'Channel',help="The channels represent the different communication modes available with the customer." \ " With each commercial opportunity, you can indicate the canall which is this opportunity source."), - 'planned_revenue': fields.float('Planned Revenue'), - 'planned_cost': fields.float('Planned Costs'), - 'som': fields.many2one('res.partner.som', 'State of Mind', help="The minds states allow to define a value scale which represents" \ - "the partner mentality in relation to our services.The scale has" \ - "to be created with a factor for each level from 0 (Very dissatisfied) to 10 (Extremely satisfied)."), 'categ_id': fields.many2one('crm.case.categ','Category', domain="[('object_id.model', '=', 'crm.project.bug')]"), - 'priority': fields.selection(crm.AVAILABLE_PRIORITIES, 'Priority'), - 'type_id': fields.many2one('crm.case.resource.type', 'Bug Type', domain="[('object_id.model', '=', 'project.issue')]"), - + 'priority': fields.selection(crm.AVAILABLE_PRIORITIES, 'Severity'), + 'type_id': fields.many2one('crm.case.resource.type', 'Version', domain="[('object_id.model', '=', 'project.issue')]"), 'partner_name': fields.char("Employee's Name", size=64), 'partner_mobile': fields.char('Mobile', size=32), 'partner_phone': fields.char('Phone', size=32), 'stage_id': fields.many2one ('crm.case.stage', 'Stage', domain="[('object_id.model', '=', 'project.issue')]"), 'project_id':fields.many2one('project.project', 'Project'), 'duration': fields.float('Duration'), - 'probability': fields.float('Probability (%)'), 'task_id': fields.many2one('project.task', 'Task', domain="[('project_id','=',project_id)]") } - def _get_project(self, cr, uid, context): user = self.pool.get('res.users').browse(cr,uid,uid, context=context) if user.context_project_id: return user.context_project_id - return False + return False def _convert(self, cr, uid, ids, xml_id, context=None): data_obj = self.pool.get('ir.model.data') @@ -79,7 +69,7 @@ class project_issue(osv.osv): if categ_id: self.write(cr, uid, ids, {'categ_id': categ_id}) return True - + def convert_to_feature(self, cr, uid, ids, context=None): return self._convert(cr, uid, ids, 'feature_request_categ', context=context) @@ -92,14 +82,10 @@ class project_issue(osv.osv): stage = self.pool.get('crm.case.stage').browse(cr, uid, stage_id, context) if not stage.on_change: return {'value':{}} - return {'value':{'probability':stage.probability}} + return {'value':{}} _defaults = { - 'project_id':_get_project, - 'probability':lambda *a:0.0, - 'planned_cost':lambda *a:0.0, - 'planned_revenue':lambda *a:0.0, - } - + 'project_id':_get_project, + } project_issue() diff --git a/addons/project_issue/project_issue_view.xml b/addons/project_issue/project_issue_view.xml index 305db272f4c..2a82ef783d3 100644 --- a/addons/project_issue/project_issue_view.xml +++ b/addons/project_issue/project_issue_view.xml @@ -11,22 +11,22 @@ Issue Categories crm.case.categ form - - [('object_id.model', '=', 'project.issue')] - {'object_id':'project.issue'} + + [('object_id.model', '=', 'project.issue')] + {'object_id':'project.issue'} # ------------------------------------------------------ - # Stage - # ------------------------------------------------------ - - Issue Stages - crm.case.stage - form - - [('object_id.model', '=', 'project.issue')] - {'object_id':'project.issue'} - - + # Stage + # ------------------------------------------------------ + + Issue Stages + crm.case.stage + form + + [('object_id.model', '=', 'project.issue')] + {'object_id':'project.issue'} + + Project Issue Tracker Form @@ -34,50 +34,38 @@ form - - - + + + + - - -