Openbravo Issue Tracking System - Openbravo ERP
View Issue Details
IDProjectCategoryView StatusDate SubmittedLast Update
0035548Openbravo ERPA. Platformpublic2017-03-17 08:362017-03-20 23:12
Reportermtaal 
Assigned Tomtaal 
PrioritynormalSeveritymajorReproducibilityhave not tried
StatusclosedResolutionfixed 
PlatformOS5OS Version
Product Version 
Target Version3.0PR17Q2Fixed in Version 
Merge Request Status
Review Assigned ToAugustoMauch
OBNetwork customer
Web browser
ModulesCore
Support ticket
Regression level
Regression date
Regression introduced in release
Regression introduced by commit
Triggers an Emergency PackNo
Summary0035548: Cross domain checks is also executed/logged when the origin of the webpos main page and the separate xhr request are the same
DescriptionThe assumption when creating the cross domain logic was that the origin was only set by the browser when the original page and the xhr have different origins. This showed to be false the origin header is always included.

This results in cross domain errors in the log if there are mobile server definitions and the multi-server preference is set to N. This results in that the browser/webpos does not have a list of servers and requests all the data from the server it was loaded from. Still the cross domain check on the server uses the mobile server definitions to check the cross domain request.

This issue only occurs when:
- mobile core is included, and
- one or more mobile server definitions are created.

It shows by messages in the log [2].

WebPOS functions properly, still there are messages in the log.

[1]
http://wiki.openbravo.com/wiki/How_to_Setup_MultiServer_Dev_Environment#Understanding_CORS [^]

[2]
223347 [http-bio-9080-exec-7] ERROR org.openbravo.mobile.core.authenticate.MobileAllowedCrossDomainsChecker - Origin http://localhost:9080 [^] is not allowed, request information: http://localhost:9080/openbravo/org.openbravo.retail.posterminal/POSLoginHandler-null [^]
231650 [http-bio-9080-exec-7] ERROR org.openbravo.mobile.core.authenticate.MobileAllowedCrossDomainsChecker - Origin http://localhost:9080 [^] is not allowed, request information: http://localhost:9080/openbravo/org.openbravo.retail.posterminal/POSLoginHandler-null [^]
Steps To Reproduce- Create mobile server definitions
- Set the urls of the mobile server to something non-existing
- Set multi-server pref to N (not needed but is from the customer case)
- Access webpos using localhost
- See messages in the log
Proposed SolutionCheck if the origin of the request is present in the request url. If so then the request is allowed and cross domain headers do not need to be set either.

Code changes can be done in the AllowedCrossDomainsHandler.

[1]
https://code.openbravo.com/erp/devel/pi/file/05c62ceaa5a6/src/org/openbravo/base/secureApp/AllowedCrossDomainsHandler.java#l63 [^]
Additional Information
TagsNo tags attached.
Relationships
related to defect 0035549RR17Q2 closed mtaal Retail Modules Cross domain checking should not use mobile servers if the multi-server preference is of 
Attached Files
Issue History
Date ModifiedUsernameFieldChange
2017-03-17 08:36mtaalNew Issue
2017-03-17 08:36mtaalAssigned To => mtaal
2017-03-17 08:36mtaalModules => Core
2017-03-17 08:36mtaalTriggers an Emergency Pack => No
2017-03-17 08:46mtaalRelationship addedrelated to 0035549
2017-03-17 10:10shuehnerResolution time => 1491516000
2017-03-17 10:14shuehnerIssue Monitored: shuehner
2017-03-19 10:17mtaalReview Assigned To => AugustoMauch
2017-03-19 10:18hgbotCheckin
2017-03-19 10:18hgbotNote Added: 0095389
2017-03-19 10:18hgbotStatusnew => resolved
2017-03-19 10:18hgbotResolutionopen => fixed
2017-03-19 10:18hgbotFixed in SCM revision => http://code.openbravo.com/erp/devel/pi/rev/fa58c10eca84fdfb956ab161e64a9fbc21d93239 [^]
2017-03-20 10:08AugustoMauchNote Added: 0095414
2017-03-20 10:08AugustoMauchStatusresolved => closed
2017-03-20 23:12hudsonbotCheckin
2017-03-20 23:12hudsonbotNote Added: 0095449

Notes
(0095389)
hgbot   
2017-03-19 10:18   
Repository: erp/devel/pi
Changeset: fa58c10eca84fdfb956ab161e64a9fbc21d93239
Author: Martin Taal <martin.taal <at> openbravo.com>
Date: Sun Mar 19 10:18:20 2017 +0100
URL: http://code.openbravo.com/erp/devel/pi/rev/fa58c10eca84fdfb956ab161e64a9fbc21d93239 [^]

Fixes issue 35548: Cross domain checks is also executed/logged when the origin
Do not check cross domain or add cors headers if the request url and origin share the same host/port.

---
M src/org/openbravo/base/secureApp/AllowedCrossDomainsHandler.java
---
(0095414)
AugustoMauch   
2017-03-20 10:08   
Code reviewed and verified
(0095449)
hudsonbot   
2017-03-20 23:12   
A changeset related to this issue has been promoted main and to the
Central Repository, after passing a series of tests.

Promotion changeset: https://code.openbravo.com/erp/devel/main/rev/ba27e12a1e16 [^]
Maturity status: Test