From de9136eed7c02720d0f8715bb59e2a1d71ba60c8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?C=C3=A9dric=20Krier?= Date: Wed, 17 Apr 2024 09:47:20 +0200 Subject: [PATCH] Do not accept compressed content from unauthenticated request Closes #13142 --- trytond/CHANGELOG | 1 + trytond/trytond/protocols/wrappers.py | 7 +++++-- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/trytond/CHANGELOG b/trytond/CHANGELOG index beb8d63222..0f5aba546e 100644 --- a/trytond/CHANGELOG +++ b/trytond/CHANGELOG @@ -1,3 +1,4 @@ +* Do not accept compressed content from unauthenticated request (#13142) * Set loading eager to visible xxx2many on form view * Add loading attribute to form view * Add a contextual read limit on Model.read diff --git a/trytond/trytond/protocols/wrappers.py b/trytond/trytond/protocols/wrappers.py index cebac4db4b..293aee1cf0 100644 --- a/trytond/trytond/protocols/wrappers.py +++ b/trytond/trytond/protocols/wrappers.py @@ -72,8 +72,11 @@ class Request(_Request): @property def decoded_data(self): if self.content_encoding == 'gzip': - zipfile = gzip.GzipFile(fileobj=BytesIO(self.data), mode='rb') - return zipfile.read() + if self.user_id: + zipfile = gzip.GzipFile(fileobj=BytesIO(self.data), mode='rb') + return zipfile.read() + else: + abort(HTTPStatus.UNSUPPORTED_MEDIA_TYPE) else: return self.data