Smile-SA/smile_openerp_addons_6.0 — Issue #3: smile_sso shared secret comparison fail
Author: kdeldycke
Created: 2012-02-29 15:17:52+00:00
State: open
Labels: smile_sso

In the `_check_security_key()` method of `smile_sso`'s `security.py` file a shared secret is compared between the web client and the server. But the latter doesn't interprets its configuration like the former, which can leads to false comparison.

For example if, if server's config file has:

web_server_authentification_key = 12345

And client has:

server.authentification_key = 12345

Then the check fail, because one is a string and the other an integer:

(Pdb) _check_security_key(security_key)
False
(Pdb) security_key
12345
(Pdb) config.get('web_server_authentification_key')
'12345'

Same problem arise if quotes are used:

web_server_authentification_key = '12345'
server.authentification_key = '12345'

(Pdb) _check_security_key(security_key)
False
(Pdb) security_key
'12345'
(Pdb) config.get('web_server_authentification_key')
"'12345'"

A quick and dirty fix is consist in casting the shared secret to integers. Should we commit this fix ?