尝试从外部应用程序命中时禁用或绕过odoo的登录

Question

我试图从我的托管应用程序打开odoo url，但它重定向到登录屏幕。由于用户已经登录到我的应用程序，逻辑上用户不应该再次重定向到登录屏幕...如何绕过odoo的安全检查???

提前致谢

Answer 1

从您的问题来看，我认为您要尝试实现的是如果该用户已经在您的非odoo应用程序中进行了身份验证，则会自动验证用户的odoo会话。为此，您可以实现您的应用程序，以便在对用户进行身份验证时，您的后端将使用相应的用户对odoo中的会话进行身份验证，并将用户浏览器的session_id cookie设置为该经过身份验证的session_id。我想这可能是可以实现的，如果两个应用程序都在相同的域下使用nginx或apache进行反向代理服务，正如其他人已经评论过的那样，你无法完全禁用或绕过odoo本身的身份验证，因为这是一个完善的业务相关软件，这将打败它的目的。

Answer 2

可以绕过odoo的安全性。这两个文件中需要进行这些更改

**server/odoo/http.py**
line number 406 in odoo 12
 def validate_csrf(self, csrf):
        # if not csrf:
        #     return False
        #
        # try:
        #     hm, _, max_ts = str(csrf).rpartition('o')
        # except UnicodeEncodeError:
        #     return False
        #
        # if max_ts:
        #     try:
        #         if int(max_ts) < int(time.time()):
        #             return False
        #     except ValueError:
        #         return False
        #
        # token = self.session.sid
        #
        # msg = '%s%s' % (token, max_ts)
        # secret = self.env['ir.config_parameter'].sudo().get_param('database.secret')
        # assert secret, "CSRF protection requires a configured database secret"
        # hm_expected = hmac.new(secret.encode('ascii'), msg.encode('utf-8'), hashlib.sha1).hexdigest()
        # return consteq(hm, hm_expected)
        return True

def setup_session(self, httprequest):
        explicit_session = True
        # recover or create session
        # session_gc(self.session_store)
        #
        # sid = httprequest.args.get('session_id')
        # explicit_session = True
        # if not sid:
        #     sid =  httprequest.headers.get("X-Openerp-Session-Id")
        # if not sid:
        #     sid = httprequest.cookies.get('session_id')
        #     explicit_session = False
        # if sid is None:
        #     httprequest.session = self.session_store.new()
        # else:
        #     httprequest.session = self.session_store.get(sid)
        httprequest.session = self.session_store.new()
        httprequest.session.uid =2
        httprequest.session.login = 'root'
        httprequest.session.db = 'odoo'
        httprequest.session.sid = '7aa5500f30365aead781465ec08bbb03c3a5024b'
        return explicit_session

line number 1348

def setup_session(self, httprequest):
        explicit_session = True
        # recover or create session
        # session_gc(self.session_store)
        #
        # sid = httprequest.args.get('session_id')
        # explicit_session = True
        # if not sid:
        #     sid =  httprequest.headers.get("X-Openerp-Session-Id")
        # if not sid:
        #     sid = httprequest.cookies.get('session_id')
        #     explicit_session = False
        # if sid is None:
        #     httprequest.session = self.session_store.new()
        # else:
        #     httprequest.session = self.session_store.get(sid)
        httprequest.session = self.session_store.new()
        httprequest.session.uid =2
        httprequest.session.login = 'root'
        httprequest.session.db = 'odoo'
        httprequest.session.sid = '7aa5500f30365aead781465ec08bbb03c3a5024b'
        return explicit_session


**server/odoo/service/security.py**
line number 18
def check_session(session, env):
    # self = env['res.users'].browse(session.uid)
    # expected = self._compute_session_token(session.sid)
    # if expected and odoo.tools.misc.consteq(expected, session.session_token):
    #     return True
    # self._invalidate_session_cache()
return True