[PATCH] Upstream patch - 16102023

addons/google_account/models/google_service.py

@@ -157,7 +157,7 @@ class GoogleService(models.AbstractModel):
         return json_result.get('access_token'), json_result.get('expires_in')
 
     @api.model
-    def _do_request(self, uri, params=None, headers=None, method='POST', preuri="https://www.googleapis.com", timeout=TIMEOUT):
+    def _do_request(self, uri, params=None, headers=None, method='POST', preuri=GOOGLE_API_BASE_URL, timeout=TIMEOUT):
         """ Execute the request to Google API. Return a tuple ('HTTP_CODE', 'HTTP_RESPONSE')
             :param uri : the url to contact
             :param params : dict or already encoded parameters for the request to make
@@ -170,6 +170,10 @@ class GoogleService(models.AbstractModel):
         if headers is None:
             headers = {}
 
+        assert urls.url_parse(preuri + uri).host in [
+            urls.url_parse(url).host for url in (GOOGLE_TOKEN_ENDPOINT, GOOGLE_API_BASE_URL)
+        ]
+
         _logger.debug("Uri: %s - Type : %s - Headers: %s - Params : %s !", (uri, method, headers, params))
 
         ask_time = fields.Datetime.now()

addons/google_calendar/tests/__init__.py

@@ -1,6 +1,7 @@
 # -*- coding: utf-8 -*-
 # Part of Odoo, Flectra. See LICENSE file for full copyright and licensing details.
 
+from . import test_google_event
 from . import test_sync_common
 from . import test_sync_google2flectra
 from . import test_sync_flectra2google

addons/google_calendar/tests/test_google_event.py

@@ -0,0 +1,15 @@
+# -*- coding: utf-8 -*-
+# Part of Odoo, Flectra. See LICENSE file for full copyright and licensing details.
+from flectra.tests.common import BaseCase
+from flectra.addons.google_calendar.utils.google_calendar import GoogleEvent
+
+
+class TestGoogleEvent(BaseCase):
+    def test_google_event_readonly(self):
+        event = GoogleEvent()
+        with self.assertRaises(TypeError):
+            event._events['foo'] = 'bar'
+        with self.assertRaises(AttributeError):
+            event._events.update({'foo': 'bar'})
+        with self.assertRaises(TypeError):
+            dict.update(event._events, {'foo': 'bar'})

addons/google_calendar/utils/google_event.py

@@ -1,6 +1,7 @@
 # -*- coding: utf-8 -*-
 # Part of Odoo, Flectra. See LICENSE file for full copyright and licensing details.
 from flectra.api import model
+from flectra.tools.misc import ReadonlyDict
 from flectra.tools.sql import existing_tables
 import pytz
 import logging
@@ -29,14 +30,15 @@ class GoogleEvent(abc.Set):
     """
 
     def __init__(self, iterable=()):
-        self._events = {}
+        _events = {}
         for item in iterable:
             if isinstance(item, self.__class__):
-                self._events[item.id] = item._events[item.id]
+                _events[item.id] = item._events[item.id]
             elif isinstance(item, Mapping):
-                self._events[item.get('id')] = item
+                _events[item.get('id')] = item
             else:
                 raise ValueError("Only %s or iterable of dict are supported" % self.__class__.__name__)
+        self._events = ReadonlyDict(_events)
 
     def __iter__(self) ->  Iterator['GoogleEvent']:
         return iter(GoogleEvent([vals]) for vals in self._events.values())

addons/microsoft_account/models/microsoft_service.py

@@ -16,6 +16,7 @@ TIMEOUT = 20
 
 MICROSOFT_AUTH_ENDPOINT = 'https://login.microsoftonline.com/common/oauth2/v2.0/authorize'
 MICROSOFT_TOKEN_ENDPOINT = 'https://login.microsoftonline.com/common/oauth2/v2.0/token'
+MICROSOFT_GRAPH_ENDPOINT = 'https://graph.microsoft.com'
 
 RESOURCE_NOT_FOUND_STATUSES = (204, 404)
 
@@ -116,7 +117,7 @@ class MicrosoftService(models.AbstractModel):
             raise self.env['res.config.settings'].get_config_warning(error_msg)
 
     @api.model
-    def _do_request(self, uri, params=None, headers=None, method='POST', preuri="https://graph.microsoft.com", timeout=TIMEOUT):
+    def _do_request(self, uri, params=None, headers=None, method='POST', preuri=MICROSOFT_GRAPH_ENDPOINT, timeout=TIMEOUT):
         """ Execute the request to Microsoft API. Return a tuple ('HTTP_CODE', 'HTTP_RESPONSE')
             :param uri : the url to contact
             :param params : dict or already encoded parameters for the request to make
@@ -129,6 +130,10 @@ class MicrosoftService(models.AbstractModel):
         if headers is None:
             headers = {}
 
+        assert urls.url_parse(preuri + uri).host in [
+            urls.url_parse(url).host for url in (MICROSOFT_TOKEN_ENDPOINT, MICROSOFT_GRAPH_ENDPOINT)
+        ]
+
         _logger.debug("Uri: %s - Type : %s - Headers: %s - Params : %s !" % (uri, method, headers, params))
 
         ask_time = fields.Datetime.now()

addons/microsoft_calendar/tests/test_microsoft_event.py

@@ -302,3 +302,12 @@ class TestMicrosoftEvent(TestCommon):
 
         self.assertNotIn(self.simple_event, synced_events)
         self.assertIn(self.simple_event, not_synced_events)
+
+    def test_microsoft_event_readonly(self):
+        event = MicrosoftEvent()
+        with self.assertRaises(TypeError):
+            event._events['foo'] = 'bar'
+        with self.assertRaises(AttributeError):
+            event._events.update({'foo': 'bar'})
+        with self.assertRaises(TypeError):
+            dict.update(event._events, {'foo': 'bar'})

addons/microsoft_calendar/utils/microsoft_event.py

@@ -3,6 +3,7 @@
 from flectra.api import model
 from typing import Iterator, Mapping
 from collections import abc
+from flectra.tools import ReadonlyDict
 from flectra.addons.microsoft_calendar.utils.event_id_storage import combine_ids
 
 
@@ -17,14 +18,15 @@ class MicrosoftEvent(abc.Set):
     """
 
     def __init__(self, iterable=()):
-        self._events = {}
+        _events = {}
         for item in iterable:
             if isinstance(item, self.__class__):
-                self._events[item.id] = item._events[item.id]
+                _events[item.id] = item._events[item.id]
             elif isinstance(item, Mapping):
-                self._events[item.get('id')] = item
+                _events[item.get('id')] = item
             else:
                 raise ValueError("Only %s or iterable of dict are supported" % self.__class__.__name__)
+        self._events = ReadonlyDict(_events)
 
     def __iter__(self) -> Iterator['MicrosoftEvent']:
         return iter(MicrosoftEvent([vals]) for vals in self._events.values())