Do not accept compressed content from unauthenticated request

Closes #13142

trytond/CHANGELOG

@@ -1,3 +1,4 @@
+* Do not accept compressed content from unauthenticated request (#13142)
 * Set loading eager to visible xxx2many on form view
 * Add loading attribute to form view
 * Add a contextual read limit on Model.read

trytond/trytond/protocols/wrappers.py

@@ -72,8 +72,11 @@ class Request(_Request):
     @property
     def decoded_data(self):
         if self.content_encoding == 'gzip':
-            zipfile = gzip.GzipFile(fileobj=BytesIO(self.data), mode='rb')
-            return zipfile.read()
+            if self.user_id:
+                zipfile = gzip.GzipFile(fileobj=BytesIO(self.data), mode='rb')
+                return zipfile.read()
+            else:
+                abort(HTTPStatus.UNSUPPORTED_MEDIA_TYPE)
         else:
             return self.data