diff --git a/access_restriction_by_ip/__manifest__.py b/access_restriction_by_ip/__manifest__.py index 73b6190f0..71811d008 100644 --- a/access_restriction_by_ip/__manifest__.py +++ b/access_restriction_by_ip/__manifest__.py @@ -21,7 +21,7 @@ ############################################################################### { 'name': 'Access Restriction By IP', - 'version': '17.0.1.0.0', + 'version': '17.0.1.0.1', 'category': 'Extra Tools', 'summary': """User can be restricted from logging in from different Ip""", 'description': """This module enhances security by allowing administrators diff --git a/access_restriction_by_ip/controllers/__init__.py b/access_restriction_by_ip/controllers/__init__.py index 206c97b3d..62648f94b 100644 --- a/access_restriction_by_ip/controllers/__init__.py +++ b/access_restriction_by_ip/controllers/__init__.py @@ -20,3 +20,4 @@ # ################################################################################ from . import access_restriction_by_ip +from . import session diff --git a/access_restriction_by_ip/controllers/session.py b/access_restriction_by_ip/controllers/session.py new file mode 100644 index 000000000..c173cabb2 --- /dev/null +++ b/access_restriction_by_ip/controllers/session.py @@ -0,0 +1,37 @@ +# -*- coding: utf-8 -*- + +import odoo +from odoo.addons.web.controllers.session import Session +from odoo import http +from odoo.exceptions import AccessError +from odoo.http import request + + +class AccessRestrict(Session): + + @http.route() + def authenticate(self, db, login, password, base_location=None): + if not http.db_filter([db]): + raise AccessError("Database not found.") + pre_uid = request.session.authenticate(db, login, password) + ip_address = request.httprequest.environ['REMOTE_ADDR'] + user = request.env['res.users'].sudo().browse(pre_uid).exists() + if user and user.allowed_ip_ids: + ip_list = set(user.allowed_ip_ids.mapped('ip_address')) + if ip_address not in ip_list: + raise AccessError("Not allowed to login from this IP") + if pre_uid != request.session.uid: + return {'uid': None} + request.session.db = db + registry = odoo.modules.registry.Registry(db) + with registry.cursor() as cr: + env = odoo.api.Environment(cr, request.session.uid, request.session.context) + if not request.db: + # request._save_session would not update the session_token + # as it lacks an environment, rotating the session myself + http.root.session_store.rotate(request.session, env) + request.future_response.set_cookie( + 'session_id', request.session.sid, + max_age=http.SESSION_LIFETIME, httponly=True + ) + return env['ir.http'].session_info() diff --git a/access_restriction_by_ip/doc/RELEASE_NOTES.md b/access_restriction_by_ip/doc/RELEASE_NOTES.md index ac911b83c..8520d155a 100644 --- a/access_restriction_by_ip/doc/RELEASE_NOTES.md +++ b/access_restriction_by_ip/doc/RELEASE_NOTES.md @@ -5,3 +5,10 @@ ##### ADD - Initial Commit for Access Restriction By IP + + +#### 14.03.2025 +#### Version 17.0.1.0.1 +##### ADD + +- Added Access Restriction By IP through odoo mobile app. \ No newline at end of file