[IMP] ir_http: don't handle exception in dev mode but use the werkzeug debugger excep...

[odoo/odoo.git] / openerp / addons / base / ir / ir_http.py

diff --git a/openerp/addons/base/ir/ir_http.py b/openerp/addons/base/ir/ir_http.py
index 4676614..c70be2c 100644 (file)
--- a/openerp/addons/base/ir/ir_http.py
+++ b/openerp/addons/base/ir/ir_http.py
@@ -7,8 +7,12 @@ import sys
 
 import werkzeug.exceptions
 import werkzeug.routing
+import werkzeug.urls
+import werkzeug.utils
 
 import openerp
+import openerp.exceptions
+import openerp.models
 from openerp import http
 from openerp.http import request
 from openerp.osv import osv, orm
@@ -41,9 +45,6 @@ class ModelsConverter(werkzeug.routing.BaseConverter):
         self.regex = '([0-9,]+)'
 
     def to_python(self, value):
-        # TODO:
-        # - raise routing.ValidationError() if no browse record can be createdm
-        # - support slug
         return request.registry[self.model].browse(request.cr, UID_PLACEHOLDER, [int(i) for i in value.split(',')], context=request.context)
 
     def to_url(self, value):
@@ -56,55 +57,71 @@ class ir_http(osv.AbstractModel):
     def _get_converters(self):
         return {'model': ModelConverter, 'models': ModelsConverter}
 
-    def _find_handler(self):
-        return self.routing_map().bind_to_environ(request.httprequest.environ).match()
+    def _find_handler(self, return_rule=False):
+        return self.routing_map().bind_to_environ(request.httprequest.environ).match(return_rule=return_rule)
 
     def _auth_method_user(self):
         request.uid = request.session.uid
         if not request.uid:
             raise http.SessionExpiredException("Session expired")
 
-    def _auth_method_admin(self):
-        if not request.db:
-            raise http.SessionExpiredException("No valid database for request %s" % request.httprequest)
-        request.uid = openerp.SUPERUSER_ID
-
     def _auth_method_none(self):
-        request.disable_db = True
         request.uid = None
 
+    def _auth_method_public(self):
+        if not request.session.uid:
+            dummy, request.uid = self.pool['ir.model.data'].get_object_reference(request.cr, openerp.SUPERUSER_ID, 'base', 'public_user')
+        else:
+            request.uid = request.session.uid
+
     def _authenticate(self, auth_method='user'):
-        if request.session.uid:
-            try:
-                request.session.check_security()
-                # what if error in security.check()
-                #   -> res_users.check()
-                #   -> res_users.check_credentials()
-            except Exception:
-                request.session.logout()
-        getattr(self, "_auth_method_%s" % auth_method)()
+        try:
+            if request.session.uid:
+                try:
+                    request.session.check_security()
+                    # what if error in security.check()
+                    #   -> res_users.check()
+                    #   -> res_users.check_credentials()
+                except (openerp.exceptions.AccessDenied, openerp.http.SessionExpiredException):
+                    # All other exceptions mean undetermined status (e.g. connection pool full),
+                    # let them bubble up
+                    request.session.logout(keep_db=True)
+            getattr(self, "_auth_method_%s" % auth_method)()
+        except (openerp.exceptions.AccessDenied, openerp.http.SessionExpiredException):
+            raise
+        except Exception:
+            _logger.exception("Exception during request Authentication.")
+            raise openerp.exceptions.AccessDenied()
         return auth_method
 
     def _handle_exception(self, exception):
-        raise
+        # If handle_exception returns something different than None, it will be used as a response
+
+        # Don't handle exception but use werkeug debugger if server in --dev mode
+        if openerp.tools.config['dev_mode']:
+            raise
+        try:
+            return request._handle_exception(exception)
+        except openerp.exceptions.AccessDenied:
+            return werkzeug.exceptions.Forbidden()
 
     def _dispatch(self):
         # locate the controller method
         try:
-            func, arguments = self._find_handler()
+            rule, arguments = self._find_handler(return_rule=True)
+            func = rule.endpoint
         except werkzeug.exceptions.NotFound, e:
             return self._handle_exception(e)
 
         # check authentication level
         try:
             auth_method = self._authenticate(func.routing["auth"])
-        except Exception:
-            # force a Forbidden exception with the original traceback
-            return self._handle_exception(
-                convert_exception_to(
-                    werkzeug.exceptions.Forbidden))
+        except Exception as e:
+            return self._handle_exception(e)
 
-        self._postprocess_args(arguments)
+        processing = self._postprocess_args(arguments, rule)
+        if processing:
+            return processing
 
         # set and execute handler
         try:
@@ -117,14 +134,14 @@ class ir_http(osv.AbstractModel):
 
         return result
 
-    def _postprocess_args(self, arguments):
+    def _postprocess_args(self, arguments, rule):
         """ post process arg to set uid on browse records """
-        for arg in arguments.itervalues():
+        for name, arg in arguments.items():
             if isinstance(arg, orm.browse_record) and arg._uid is UID_PLACEHOLDER:
-                arg._uid = request.uid
+                arguments[name] = arg.sudo(request.uid)
                 try:
-                    arg[arg._rec_name]
-                except KeyError:
+                    arg.exists()
+                except openerp.models.MissingError:
                     return self._handle_exception(werkzeug.exceptions.NotFound())
 
     def routing_map(self):
@@ -134,7 +151,9 @@ class ir_http(osv.AbstractModel):
             m = request.registry.get('ir.module.module')
             ids = m.search(cr, openerp.SUPERUSER_ID, [('state', '=', 'installed'), ('name', '!=', 'web')], context=request.context)
             installed = set(x['name'] for x in m.read(cr, 1, ids, ['name'], context=request.context))
-            mods = ['', "web"] + sorted(installed)
+            if openerp.tools.config['test_enable']:
+                installed.add(openerp.modules.module.current_test)
+            mods = [''] + openerp.conf.server_wide_modules + sorted(installed)
             self._routing_map = http.routing_map(mods, False, converters=self._get_converters())
 
         return self._routing_map