From ae8e4ec59deea6063bd912d6be0f62e4e5a8bc3b Mon Sep 17 00:00:00 2001 From: Guewen Baconnier Date: Mon, 8 Oct 2018 10:04:36 +0200 Subject: [PATCH] Prevent to send web notifications to other users Only the admin user (sudo) is allowed to send notifications to other users. The normal users can only send notifications to themselves. This is to prevent attackers to craft malicious notifications and send them to other users using RPC. Correction based on the idea of @hbrunn --- web_notify/__manifest__.py | 2 +- web_notify/models/res_users.py | 7 ++++++- web_notify/tests/test_res_users.py | 11 +++++++++++ 3 files changed, 18 insertions(+), 2 deletions(-) diff --git a/web_notify/__manifest__.py b/web_notify/__manifest__.py index 9b152fe6..0ad8d42f 100644 --- a/web_notify/__manifest__.py +++ b/web_notify/__manifest__.py @@ -5,7 +5,7 @@ 'name': 'Web Notify', 'summary': """ Send notification messages to user""", - 'version': '11.0.1.0.0', + 'version': '11.0.1.1.0', 'description': 'Web Notify', 'license': 'AGPL-3', 'author': 'ACSONE SA/NV,Odoo Community Association (OCA)', diff --git a/web_notify/models/res_users.py b/web_notify/models/res_users.py index 82563eae..25f65084 100644 --- a/web_notify/models/res_users.py +++ b/web_notify/models/res_users.py @@ -1,7 +1,7 @@ # Copyright 2016 ACSONE SA/NV # License AGPL-3.0 or later (http://www.gnu.org/licenses/agpl). -from odoo import api, fields, models, _ +from odoo import api, exceptions, fields, models, _, SUPERUSER_ID class ResUsers(models.Model): @@ -35,6 +35,11 @@ class ResUsers(models.Model): @api.multi def _notify_channel(self, channel_name_field, message, title, sticky): + if (self.env.uid != SUPERUSER_ID + and any(user.id != self.env.uid for user in self)): + raise exceptions.UserError( + _('Sending a notification to another user is forbidden.') + ) bus_message = { 'message': message, 'title': title, diff --git a/web_notify/tests/test_res_users.py b/web_notify/tests/test_res_users.py index 80c26042..2f336a27 100644 --- a/web_notify/tests/test_res_users.py +++ b/web_notify/tests/test_res_users.py @@ -1,6 +1,7 @@ # Copyright 2016 ACSONE SA/NV # License AGPL-3.0 or later (http://www.gnu.org/licenses/agpl). +from odoo import exceptions from odoo.tests import common from odoo.addons.bus.models.bus import json_dump import json @@ -55,3 +56,13 @@ class TestResUsers(common.TransactionCase): first_pos_call_args = pos_call_args[0] self.assertIsInstance(first_pos_call_args, list) self.assertEqual(len(users), len(first_pos_call_args)) + + def test_notify_other_user(self): + other_user = self.env.ref('base.user_demo') + other_user_model = self.env['res.users'].sudo(other_user) + with self.assertRaises(exceptions.UserError): + other_user_model.browse(self.env.uid).notify_info('hello') + + def test_notify_admin_allowed_other_user(self): + other_user = self.env.ref('base.user_demo') + other_user.notify_info('hello')