From b2a44a962ca3c3b496b368343eda134726799bb7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Krier?= <ced@b2ck.com>
Date: Wed, 12 Jun 2019 19:04:42 +0200
Subject: [PATCH] Prevent modification of cache RPC answers

The cached value should never be changed after being stored by the setter or
by a getter. So we make a copy of the value before storing it and return
another copy when returned.

issue8387
review269601002
---
 tryton/jsonrpc.py | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/tryton/jsonrpc.py b/tryton/jsonrpc.py
index ffface069b..3ab0d70acd 100644
--- a/tryton/jsonrpc.py
+++ b/tryton/jsonrpc.py
@@ -1,5 +1,6 @@
 # This file is part of Tryton.  The COPYRIGHT file at the top level of
 # this repository contains the full copyright notices and license terms.
+import copy
 import xmlrpc.client
 import json
 import ssl
@@ -402,7 +403,7 @@ class _Cache:
             expire = datetime.timedelta(seconds=expire)
         if isinstance(expire, datetime.timedelta):
             expire = datetime.datetime.now() + expire
-        self.store[prefix][key] = (expire, value)
+        self.store[prefix][key] = (expire, copy.deepcopy(value))
 
     def get(self, prefix, key):
         now = datetime.datetime.now()
@@ -414,7 +415,7 @@ class _Cache:
             self.store.pop(key)
             raise KeyError
         logger.info('(cached) %s %s', prefix, key)
-        return value
+        return copy.deepcopy(value)
 
     def clear(self, prefix=None):
         if prefix: