From 038cdc66b94d33d7e2d6b86c42bbb0852cb975a0 Mon Sep 17 00:00:00 2001 From: Olivier Dony Date: Tue, 21 Jun 2022 13:14:49 +0000 Subject: [PATCH] [IMP] auth_totp: add trusted device method to validate user Adds a variant `_check_credentials_for_uid()` for auth_totp.device's `_check_credentials()`. The new method will directly verify the device key matches the given uid. This spares the redundant uid comparison on the caller side, and allows extension modules to customise the user/device matching logic. closes odoo/odoo#94365 X-original-commit: 0e266eb3c73409950d1eb160c41eb6668d439856 Signed-off-by: Olivier Dony --- addons/auth_totp/controllers/home.py | 5 +++-- addons/auth_totp/models/auth_totp.py | 5 +++++ 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/addons/auth_totp/controllers/home.py b/addons/auth_totp/controllers/home.py index 40e41eefc0e..aaeae55de76 100644 --- a/addons/auth_totp/controllers/home.py +++ b/addons/auth_totp/controllers/home.py @@ -30,8 +30,9 @@ class Home(web_home.Home): cookies = request.httprequest.cookies key = cookies.get(TRUSTED_DEVICE_COOKIE) if key: - checked_credentials = request.env['auth_totp.device']._check_credentials(scope="browser", key=key) - if checked_credentials == user.id: + user_match = request.env['auth_totp.device']._check_credentials_for_uid( + scope="browser", key=key, uid=user.id) + if user_match: request.session.finalize(request.env) return request.redirect(self._login_redirect(request.session.uid, redirect=redirect)) diff --git a/addons/auth_totp/models/auth_totp.py b/addons/auth_totp/models/auth_totp.py index 38ac76df4a4..ac97cd2f5bc 100644 --- a/addons/auth_totp/models/auth_totp.py +++ b/addons/auth_totp/models/auth_totp.py @@ -12,3 +12,8 @@ class AuthTotpDevice(models.Model): _inherit = "res.users.apikeys" _description = "Authentication Device" _auto = False + + def _check_credentials_for_uid(self, *, scope, key, uid): + """Return True if device key matches given `scope` for user ID `uid`""" + assert uid, "uid is required" + return self._check_credentials(scope=scope, key=key) == uid