From bf9fb3a23eb7b9d002de1f55bf9bb28645966d79 Mon Sep 17 00:00:00 2001 From: Guewen Baconnier Date: Mon, 8 Oct 2018 10:04:36 +0200 Subject: [PATCH] Prevent to send web notifications to other users Only the admin user (sudo) is allowed to send notifications to other users. The normal users can only send notifications to themselves. This is to prevent attackers to craft malicious notifications and send them to other users using RPC. Correction based on the idea of @hbrunn --- web_notify/models/res_users.py | 7 ++++++- web_notify/tests/test_res_users.py | 11 +++++++++++ 2 files changed, 17 insertions(+), 1 deletion(-) diff --git a/web_notify/models/res_users.py b/web_notify/models/res_users.py index 82563eae..25f65084 100644 --- a/web_notify/models/res_users.py +++ b/web_notify/models/res_users.py @@ -1,7 +1,7 @@ # Copyright 2016 ACSONE SA/NV # License AGPL-3.0 or later (http://www.gnu.org/licenses/agpl). -from odoo import api, fields, models, _ +from odoo import api, exceptions, fields, models, _, SUPERUSER_ID class ResUsers(models.Model): @@ -35,6 +35,11 @@ class ResUsers(models.Model): @api.multi def _notify_channel(self, channel_name_field, message, title, sticky): + if (self.env.uid != SUPERUSER_ID + and any(user.id != self.env.uid for user in self)): + raise exceptions.UserError( + _('Sending a notification to another user is forbidden.') + ) bus_message = { 'message': message, 'title': title, diff --git a/web_notify/tests/test_res_users.py b/web_notify/tests/test_res_users.py index 80c26042..2f336a27 100644 --- a/web_notify/tests/test_res_users.py +++ b/web_notify/tests/test_res_users.py @@ -1,6 +1,7 @@ # Copyright 2016 ACSONE SA/NV # License AGPL-3.0 or later (http://www.gnu.org/licenses/agpl). +from odoo import exceptions from odoo.tests import common from odoo.addons.bus.models.bus import json_dump import json @@ -55,3 +56,13 @@ class TestResUsers(common.TransactionCase): first_pos_call_args = pos_call_args[0] self.assertIsInstance(first_pos_call_args, list) self.assertEqual(len(users), len(first_pos_call_args)) + + def test_notify_other_user(self): + other_user = self.env.ref('base.user_demo') + other_user_model = self.env['res.users'].sudo(other_user) + with self.assertRaises(exceptions.UserError): + other_user_model.browse(self.env.uid).notify_info('hello') + + def test_notify_admin_allowed_other_user(self): + other_user = self.env.ref('base.user_demo') + other_user.notify_info('hello')