Question

我正在尝试从托管的应用程序打开odoo网址，但其重定向到登录屏幕。由于用户已经从逻辑上登录到我的应用程序中，因此不应再次将用户重定向到登录屏幕...我如何绕过odoo的安全检查？

预先感谢

Answer 1

从您的问题开始，我认为您要实现的是，如果已经在您的非odoo应用程序中对该用户进行了身份验证，则该用户的odoo会话将自动进行身份验证。为此，您可以实现应用程序，以便在对用户进行身份验证时，后端将在odoo中与相应用户进行会话身份验证，并将用户浏览器的session_id Cookie设置为该身份验证的session_id。我想如果两个应用程序都使用nginx或apache通过反向代理在同一个域下提供服务，那可能是可以实现的，正如其他人已经评论过的那样，您无法完全禁用或绕过odoo本身的身份验证，因为这是一个与商业相关的发达软件，这只会破坏它的目的。

Answer 2

可以绕过odoo的安全性。这两个文件中需要进行这些更改 `

**server/odoo/http.py**
line number 406 in odoo 12
 def validate_csrf(self, csrf):
        # if not csrf:
        #     return False
        #
        # try:
        #     hm, _, max_ts = str(csrf).rpartition('o')
        # except UnicodeEncodeError:
        #     return False
        #
        # if max_ts:
        #     try:
        #         if int(max_ts) < int(time.time()):
        #             return False
        #     except ValueError:
        #         return False
        #
        # token = self.session.sid
        #
        # msg = '%s%s' % (token, max_ts)
        # secret = self.env['ir.config_parameter'].sudo().get_param('database.secret')
        # assert secret, "CSRF protection requires a configured database secret"
        # hm_expected = hmac.new(secret.encode('ascii'), msg.encode('utf-8'), hashlib.sha1).hexdigest()
        # return consteq(hm, hm_expected)
        return True

def setup_session(self, httprequest):
        explicit_session = True
        # recover or create session
        # session_gc(self.session_store)
        #
        # sid = httprequest.args.get('session_id')
        # explicit_session = True
        # if not sid:
        #     sid =  httprequest.headers.get("X-Openerp-Session-Id")
        # if not sid:
        #     sid = httprequest.cookies.get('session_id')
        #     explicit_session = False
        # if sid is None:
        #     httprequest.session = self.session_store.new()
        # else:
        #     httprequest.session = self.session_store.get(sid)
        httprequest.session = self.session_store.new()
        httprequest.session.uid =2
        httprequest.session.login = 'root'
        httprequest.session.db = 'odoo'
        httprequest.session.sid = '7aa5500f30365aead781465ec08bbb03c3a5024b'
        return explicit_session

line number 1348

def setup_session(self, httprequest):
        explicit_session = True
        # recover or create session
        # session_gc(self.session_store)
        #
        # sid = httprequest.args.get('session_id')
        # explicit_session = True
        # if not sid:
        #     sid =  httprequest.headers.get("X-Openerp-Session-Id")
        # if not sid:
        #     sid = httprequest.cookies.get('session_id')
        #     explicit_session = False
        # if sid is None:
        #     httprequest.session = self.session_store.new()
        # else:
        #     httprequest.session = self.session_store.get(sid)
        httprequest.session = self.session_store.new()
        httprequest.session.uid =2
        httprequest.session.login = 'root'
        httprequest.session.db = 'odoo'
        httprequest.session.sid = '7aa5500f30365aead781465ec08bbb03c3a5024b'
        return explicit_session


**server/odoo/service/security.py**
line number 18
def check_session(session, env):
    # self = env['res.users'].browse(session.uid)
    # expected = self._compute_session_token(session.sid)
    # if expected and odoo.tools.misc.consteq(expected, session.session_token):
    #     return True
    # self._invalidate_session_cache()
return True

尝试从外部应用程序进行攻击时禁用或绕过odoo登录

2 个答案: