From 011d55d3e1f9d50fc5a3001a4a7ce47ec27cdc48 Mon Sep 17 00:00:00 2001 From: Xavier Morel Date: Wed, 19 Aug 2020 13:19:57 +0000 Subject: [PATCH] [FIX] auth_totp: session update after enabling or disabling totp bfcc7dee8f40afb5f7dec4e2cf5a669c0682e2ed tried to fix the session disconnection issue, but the fix only worked in single-process (either threaded or workers=1): because the cache was cleared but the update not flushed, since `_compute_session_token` uses SQL directly it would recompute the old session_token which it would cache, and thus the process would carry-on with the old token just re-set in the session and cache. Meanwhile in multi-process, odds are good that the next request will be on a different worker which *will* see the change, and will immediately complain & destroy the session. Add the missing flush calls right before recomputing the session token so the SQL "sees" the correct state. --- addons/auth_totp/models/res_users.py | 2 ++ 1 file changed, 2 insertions(+) diff --git a/addons/auth_totp/models/res_users.py b/addons/auth_totp/models/res_users.py index 855a92e0f35..06aad891550 100644 --- a/addons/auth_totp/models/res_users.py +++ b/addons/auth_totp/models/res_users.py @@ -68,6 +68,7 @@ class Users(models.Model): self.sudo().totp_secret = secret if request: + self.flush() # update session token so the user does not get logged out (cache cleared by change) new_token = self.env.user._compute_session_token(request.session.sid) request.session.session_token = new_token @@ -83,6 +84,7 @@ class Users(models.Model): self.sudo().write({'totp_secret': False}) if request and self == self.env.user: + self.flush() # update session token so the user does not get logged out (cache cleared by change) new_token = self.env.user._compute_session_token(request.session.sid) request.session.session_token = new_token