41 lines
1.6 KiB
Python
41 lines
1.6 KiB
Python
# -*- coding: utf-8 -*-
|
|
from odoo import models
|
|
from odoo.http import request
|
|
import logging
|
|
|
|
_logger = logging.getLogger(__name__)
|
|
|
|
|
|
class IrHttp(models.AbstractModel):
|
|
_inherit = 'ir.http'
|
|
|
|
@classmethod
|
|
def _pre_dispatch(cls, rule, args):
|
|
"""
|
|
Sanitize allowed_company_ids in the request context BEFORE the
|
|
environment is fully used. This prevents AccessError from
|
|
environments.py when the browser cookie (cids) contains company IDs
|
|
that are not in the user's authorized _get_company_ids() list.
|
|
|
|
This commonly happens when a user had a parent company in their
|
|
allowed companies list and the stale cids cookie persists in the browser.
|
|
"""
|
|
try:
|
|
if request.env.uid and request.session.context.get('allowed_company_ids'):
|
|
cids = request.session.context['allowed_company_ids']
|
|
user_cids = set(request.env.user._get_company_ids())
|
|
valid_cids = [c for c in cids if c in user_cids]
|
|
if not valid_cids:
|
|
valid_cids = [request.env.user.company_id.id]
|
|
if valid_cids != cids:
|
|
_logger.warning(
|
|
"IrHttp: sanitizing allowed_company_ids for %s: %s -> %s",
|
|
request.env.user.login, cids, valid_cids
|
|
)
|
|
request.session.context['allowed_company_ids'] = valid_cids
|
|
request.update_context(allowed_company_ids=valid_cids)
|
|
except Exception as e:
|
|
_logger.debug("IrHttp: could not sanitize company context: %s", e)
|
|
|
|
return super()._pre_dispatch(rule, args)
|