Odoo Changelog — 2020-06-25

Thursday, June 25, 2020

2 changes

Bug Fixes(2)

Resolved issues and error corrections

Revert "[REM] iot_pairing: IoT Box Connection"

Enterprisemasteriotiot_pairingMEDIUM

This change rolls back the recently introduced IoT pairing module because it caused upgrade issues across saas-13.4 branches. Reverting it helps keep deployments stable while upgrade scripts are corrected before the feature is reintroduced.

Original PR description

A skipci was made in order to merge a new module `iot_pairing` in saas-13.4.
Unfortunately after the module reached master, beb3851 was introduced before new saas-13.4 database
were generated, allowing to merge the change in master but introducing the failure in saas-13.4
for all other branches.
The failure should appear in master after saas-13.4 nightly.
This reverts commit beb3851 waiting for a fix nof upgrade scripts.

#iot#rollback#upgrade-stability

[FIX] iot_pairing: IoT Box connection

PR #11421

Enterprisemasteriotiot_pairingSECURITY

IoT Boxes now connect through a short-lived manual pairing code instead of direct browser communication, avoiding issues caused by browsers blocking mixed content. This keeps customers able to register new IoT Boxes securely and reliably as browser security rules tighten.

Original PR description

In Chrome 84, mixed content will be completely blocked for security
reasons ([see blog](https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html))
Other browsers will probably follow in the next months.

As IoT Boxes don't have a valid certificate before connecting to a DB,
we used mixed passive content to communicate with the boxes.
This won't be possible anymore, and we have no possible way to
communicate directly from the browser to the box.

- When an IoT Box boots without registered DB, a unique code will be
 created with a validity of 5 minutes.
- This code will be shown on the customer display and printed on the
 status ticket.
- The box will call a route on odoo.com and a record will be created
 in odoo.com with the unique code.
- The user will have to enter the code manually in his DB to connect
 to the IoT Box, the DB will then contact odoo.com to search for a
 record containing the unique code. If it's found, the
 `openerp.enterprise.database` will be added to the record.
- The box will then query odoo.com at regular intervals (10 seconds)
 to check if a DB is linked to the code.

Taskid: 2246535
X-original-commit: 05de66e6ea815e32b463f1e49e974d30fcf05ac4

#IoT Box#pairing#browser security

A skipci was made in order to merge a new module `iot_pairing` in saas-13.4. Unfortunately after the module reached master, beb3851 was introduced before new saas-13.4 database were generated, allowing to merge the change in master but introducing the failure in saas-13.4 for all other branches. The failure should appear in master after saas-13.4 nightly. This reverts commit beb3851 waiting for a fix nof upgrade scripts.

In Chrome 84, mixed content will be completely blocked for security reasons ([see blog](https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html)) Other browsers will probably follow in the next months. As IoT Boxes don't have a valid certificate before connecting to a DB, we used mixed passive content to communicate with the boxes. This won't be possible anymore, and we have no possible way to communicate directly from the browser to the box. - When an IoT Box boots without registered DB, a unique code will be created with a validity of 5 minutes. - This code will be shown on the customer display and printed on the status ticket. - The box will call a route on odoo.com and a record will be created in odoo.com with the unique code. - The user will have to enter the code manually in his DB to connect to the IoT Box, the DB will then contact odoo.com to search for a record containing the unique code. If it's found, the `openerp.enterprise.database` will be added to the record. - The box will then query odoo.com at regular intervals (10 seconds) to check if a DB is linked to the code. Taskid: 2246535 X-original-commit: 05de66e6ea815e32b463f1e49e974d30fcf05ac4