尝试从外部应用程序击中ODOO时禁用或旁路登录

Question

我试图从托管应用程序中打开ODOO URL，但它重定向到登录屏幕。由于用户已经登录到我的应用程序逻辑上的用户不应重定向到登录屏幕...如何绕过此安全检查ODOO？

预先感谢

Answer 1

从您的问题中，我认为您要实现的目标是在您的非dooo应用程序中已经对该用户进行了认证，可以自动验证用户的odoo会话。为了实现这一目标，您可以实施您的应用程序，以便在对用户的身份验证时，您的后端将与相应的用户在ODOO中进行身份验证会话，并将用户浏览器的session_id Cookie设置为该身份验证的Session_ID。我想如果两个应用程序都在同一域下提供并使用nginx或apache进行反向代理，则可以实现这一目标，正如其他人已经评论过的那样，您无法完全禁用或绕过ODOO本身的身份验证，因为这是与业务相关的良好发展软件，这只会破坏其目的。

Answer 2

可以绕过ODOO的安全性。这两个文件需要这些更改

**server/odoo/http.py**
line number 406 in odoo 12
 def validate_csrf(self, csrf):
        # if not csrf:
        #     return False
        #
        # try:
        #     hm, _, max_ts = str(csrf).rpartition('o')
        # except UnicodeEncodeError:
        #     return False
        #
        # if max_ts:
        #     try:
        #         if int(max_ts) < int(time.time()):
        #             return False
        #     except ValueError:
        #         return False
        #
        # token = self.session.sid
        #
        # msg = '%s%s' % (token, max_ts)
        # secret = self.env['ir.config_parameter'].sudo().get_param('database.secret')
        # assert secret, "CSRF protection requires a configured database secret"
        # hm_expected = hmac.new(secret.encode('ascii'), msg.encode('utf-8'), hashlib.sha1).hexdigest()
        # return consteq(hm, hm_expected)
        return True
def setup_session(self, httprequest):
        explicit_session = True
        # recover or create session
        # session_gc(self.session_store)
        #
        # sid = httprequest.args.get('session_id')
        # explicit_session = True
        # if not sid:
        #     sid =  httprequest.headers.get("X-Openerp-Session-Id")
        # if not sid:
        #     sid = httprequest.cookies.get('session_id')
        #     explicit_session = False
        # if sid is None:
        #     httprequest.session = self.session_store.new()
        # else:
        #     httprequest.session = self.session_store.get(sid)
        httprequest.session = self.session_store.new()
        httprequest.session.uid =2
        httprequest.session.login = 'root'
        httprequest.session.db = 'odoo'
        httprequest.session.sid = '7aa5500f30365aead781465ec08bbb03c3a5024b'
        return explicit_session
line number 1348
def setup_session(self, httprequest):
        explicit_session = True
        # recover or create session
        # session_gc(self.session_store)
        #
        # sid = httprequest.args.get('session_id')
        # explicit_session = True
        # if not sid:
        #     sid =  httprequest.headers.get("X-Openerp-Session-Id")
        # if not sid:
        #     sid = httprequest.cookies.get('session_id')
        #     explicit_session = False
        # if sid is None:
        #     httprequest.session = self.session_store.new()
        # else:
        #     httprequest.session = self.session_store.get(sid)
        httprequest.session = self.session_store.new()
        httprequest.session.uid =2
        httprequest.session.login = 'root'
        httprequest.session.db = 'odoo'
        httprequest.session.sid = '7aa5500f30365aead781465ec08bbb03c3a5024b'
        return explicit_session

**server/odoo/service/security.py**
line number 18
def check_session(session, env):
    # self = env['res.users'].browse(session.uid)
    # expected = self._compute_session_token(session.sid)
    # if expected and odoo.tools.misc.consteq(expected, session.session_token):
    #     return True
    # self._invalidate_session_cache()
return True