TIP: You can type at any time to perform a new search.
Romania - Account ANAF Sync
l10n_ro_account_anaf_sync · OCA/l10n-romania
⚠ Security warnings
/l10n_ro_account_anaf_sync/redirect_anaf/<int:anaf_config_id>— HTTP endpoint 'AccountANAFSyncWeb.redirect_anaf' disables CSRF protection while requiring an authenticated session: a malicious page can act on behalf of the logged-in user route-user-csrf-off
Found by automated static analysis: these patterns are usually risky, but only a manual review of the module can confirm a real issue.
- Repository
- OCA/l10n-romania · module folder · Try on Runboat
- Module version
- 1.6.0
- Category
- Localization
- Folder size
- 2.21 MB
- License
- AGPL-3
- Application
- No
- Auto-installable
- No
- Website
- https://github.com/OCA/l10n-romania
- Last tracking update
- 2026-08-07 08:23:12
- Authors
- Odoo Community Association (OCA), NextERP Romania
- Maintainers
- Odoo Community Association (OCA), NextERP Romania
- Committers
- Dorin Hongu, Weblate, OCA-git-bot, oca-ci, Răzvan Ioan Anastasescu
- Odoo dependencies
- Python dependencies
- PyJWT
- System dependencies
- None
- Required by
- l10n_ro_etransport
- Description
This module will make posible to send e-invoice / e-transport to Romanian goverment anaf.ro. To use this module you must have a digital signature usb token from Romania connected with a ANAF account.
Code Analysis ⓘ
Views touched (4)
| XML ID | Name | Model | Type | Status |
|---|---|---|---|---|
redirect_anaf |
redirect_anaf | ir.ui.view | qweb | New |
res_config_settings_view_form |
res.config.settings.view.form.inherit | res.config.settings | form | Inherits l10n_ro_config.res_config_settings_view_form |
view_l10n_ro_account_anaf_sync_form |
l10n.ro.account.anaf.sync.form | l10n.ro.account.anaf.sync | form | New |
view_l10n_ro_account_anaf_sync_tree |
l10n.ro.account.anaf.sync.tree | l10n.ro.account.anaf.sync | tree | New |
HTTP endpoints (2)
| Route(s) | Handler | Auth | Type | Methods | Flags |
|---|---|---|---|---|---|
/l10n_ro_account_anaf_sync/anaf_oauth/<int:anaf_config_id> |
AccountANAFSyncWeb.get_anaf_oauth_code |
public | http | ALL | csrf off sudo website |
/l10n_ro_account_anaf_sync/redirect_anaf/<int:anaf_config_id> |
AccountANAFSyncWeb.redirect_anaf |
user | http | ALL | csrf off sudo website |
Models touched (3)
New fields (13)
-
access_tokenCharhelp='Received from ANAF'tracking=1 -
anaf_callback_urlCharcompute='_compute_anaf_callback_url'help='This is the address to set in anaf_portal_url (and will work if is https & accessible form internet)' -
anaf_oauth_urlChardefault='https://logincert.anaf.ro/anaf-oauth2/v1' -
anaf_scope_idsOne2many → l10n.ro.account.anaf.sync.scopecomodel_name='l10n.ro.account.anaf.sync.scope'inverse_name='anaf_sync_id' -
client_idCharhelp='From ANAF site the Oauth id - view the readme'tracking=1 -
client_secretCharhelp='From ANAF site the Oauth id - view the readme'tracking=1 -
client_token_valabilityDatehelp='Date when is going to expire - 90 days from when was generated'tracking=1 -
codeCharhelp='Received from ANAF with this you can take access token and refresh_token'tracking=1 -
company_idMany2one → res.companyrequired=True args: 'res.company' -
last_request_datetimeDatetimehelp='Time when was last time pressed the Get Token From Anaf Website. It waits for ANAF request for maximum 1 minute' -
refresh_tokenCharhelp='Received from ANAF'tracking=1 -
response_secretCharhelp='A generated secret to know that the response is ok' -
stateSelectiondefault='test' args: [('test', 'Test'), ('automatic', 'Automatic')]
-
get_token_from_anaf_website(self) -
handle_anaf_callback(self, authorization_code) -
name_get(self) -
refresh_access_token(self) -
revoke_access_token(self) -
test_anaf_api(self) -
write(self, values)
New fields (7)
-
anaf_sync_idMany2one → l10n.ro.account.anaf.syncargs: 'l10n.ro.account.anaf.sync' -
anaf_sync_production_urlCharstring='API production URL' -
anaf_sync_test_urlCharstring='API test URL' -
anaf_sync_urlCharcompute='_compute_anaf_sync_url' -
company_idMany2onerelated='anaf_sync_id.company_id'store=True -
scopeSelectionargs: [] -
stateSelectiondefault='test' args: [('test', 'Test'), ('production', 'Production')]
No public methods.
New fields (0)
No new fields.
Public methods (0)No public methods.
Loading…
Loading…
Loading…