pengyuthon/odoo_source
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[FIX+REVERT] service: bad security issue revid:jvo@tinyerp.com-20090626061715-bn1k859v5wp1k9i1

Browse Source 
bzr revid: hmo@tinyerp.com-20091211110312-cw393q16y1pmvubu
This commit is contained in:
Harry (Open ERP)
2009-12-11 16:33:12 +05:30
parent 3c930e3935
commit 055e2de6ed
1 changed files with 12 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
bin/service/security.py
+12 -15
View File
@@ -26,11 +26,10 @@ import tools
_uid_cache = {}
def login(db, login, password):
cr = pooler.get_db(db).cursor()
if password:
cr.execute('select id from res_users where login=%s and password=%s and active', (tools.ustr(login), tools.ustr(password)))
else:
cr.execute('select id from res_users where login=%s and password is null and active', (tools.ustr(login),))
if not password:
return False
cr = pooler.get_db(db).cursor()
cr.execute('select id from res_users where login=%s and password=%s and active', (tools.ustr(login), tools.ustr(password)))
res = cr.fetchone()
cr.close()
if res:
@@ -45,14 +44,13 @@ def check_super(passwd):
raise Exception('AccessDenied')
def check(db, uid, passwd):
if not passwd:
return False
cached_pass = _uid_cache.get(db, {}).get(uid)
if (cached_pass is not None) and cached_pass == passwd:
return True
cr = pooler.get_db(db).cursor()
if passwd:
cr.execute('select count(1) from res_users where id=%s and password=%s and active=%s', (int(uid), passwd, True))
else:
cr.execute('select count(1) from res_users where id=%s and password is null and active=%s', (int(uid), True))
cr = pooler.get_db(db).cursor()
cr.execute('select count(1) from res_users where id=%s and password=%s and active=%s', (int(uid), passwd, True))
res = cr.fetchone()[0]
cr.close()
if not bool(res):
@@ -66,11 +64,10 @@ def check(db, uid, passwd):
return bool(res)
def access(db, uid, passwd, sec_level, ids):
cr = pooler.get_db(db).cursor()
if passwd:
cr.execute('select id from res_users where id=%s and password=%s', (uid, passwd))
else:
cr.execute('select id from res_users where id=%s and password is null', (uid,))
if not passwd:
return False
cr = pooler.get_db(db).cursor()
cr.execute('select id from res_users where id=%s and password=%s', (uid, passwd))
res = cr.fetchone()
cr.close()
if not res: