From 055e2de6ed4666ab9a52b4bd3f96d33acf374251 Mon Sep 17 00:00:00 2001
From: "Harry (Open ERP)" <hmo@tinyerp.com>
Date: Fri, 11 Dec 2009 16:33:12 +0530
Subject: [PATCH] [FIX+REVERT] service: bad security issue
 revid:jvo@tinyerp.com-20090626061715-bn1k859v5wp1k9i1

bzr revid: hmo@tinyerp.com-20091211110312-cw393q16y1pmvubu
---
 bin/service/security.py | 27 ++++++++++++---------------
 1 file changed, 12 insertions(+), 15 deletions(-)

diff --git a/bin/service/security.py b/bin/service/security.py
index 5c9e91975c7..e05c9caab86 100644
--- a/bin/service/security.py
+++ b/bin/service/security.py
@@ -26,11 +26,10 @@ import tools
 _uid_cache = {}
 
 def login(db, login, password):
-    cr = pooler.get_db(db).cursor()
-    if password:
-        cr.execute('select id from res_users where login=%s and password=%s and active', (tools.ustr(login), tools.ustr(password)))
-    else:
-        cr.execute('select id from res_users where login=%s and password is null and active', (tools.ustr(login),))
+    if not password:
+        return False
+    cr = pooler.get_db(db).cursor()    
+    cr.execute('select id from res_users where login=%s and password=%s and active', (tools.ustr(login), tools.ustr(password)))
     res = cr.fetchone()
     cr.close()
     if res:
@@ -45,14 +44,13 @@ def check_super(passwd):
         raise Exception('AccessDenied')
 
 def check(db, uid, passwd):
+    if not passwd:
+        return False
     cached_pass = _uid_cache.get(db, {}).get(uid)
     if (cached_pass is not None) and cached_pass == passwd:
         return True
-    cr = pooler.get_db(db).cursor()
-    if passwd:
-        cr.execute('select count(1) from res_users where id=%s and password=%s and active=%s', (int(uid), passwd, True))
-    else:
-        cr.execute('select count(1) from res_users where id=%s and password is null and active=%s', (int(uid), True))    
+    cr = pooler.get_db(db).cursor()    
+    cr.execute('select count(1) from res_users where id=%s and password=%s and active=%s', (int(uid), passwd, True))    
     res = cr.fetchone()[0]
     cr.close()
     if not bool(res):
@@ -66,11 +64,10 @@ def check(db, uid, passwd):
     return bool(res)
 
 def access(db, uid, passwd, sec_level, ids):
-    cr = pooler.get_db(db).cursor()
-    if passwd:
-        cr.execute('select id from res_users where id=%s and password=%s', (uid, passwd))
-    else:
-        cr.execute('select id from res_users where id=%s and password is null', (uid,))    
+    if not passwd:
+        return False
+    cr = pooler.get_db(db).cursor()    
+    cr.execute('select id from res_users where id=%s and password=%s', (uid, passwd))
     res = cr.fetchone()
     cr.close()
     if not res: