pengyuthon/odoo_source
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[FIX] security issue: avoid access to inactive users

Browse Source 
[FIX] security issue: avoid access with 'None' password (Thanks to P. Christeas for the bug report)

bzr revid: christophe@tinyerp.com-20090813111224-f05a3z5i0wvewy85
This commit is contained in:
Christophe Simonis
2009-08-13 13:12:24 +02:00
parent e0a62de1ad
commit 06c062e6cf
1 changed files with 4 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
bin/service/security.py
+4 -3
View File
@@ -45,13 +45,14 @@ def check_super(passwd):
raise Exception('AccessDenied')
def check(db, uid, passwd):
if _uid_cache.get(db, {}).get(uid) == passwd:
cached_pass = _uid_cache.get(db, {}).get(uid)
if (cached_pass is not None) and cached_pass == passwd:
return True
cr = pooler.get_db(db).cursor()
if passwd:
cr.execute('select count(*) from res_users where id=%s and password=%s', (int(uid), passwd))
cr.execute('select count(1) from res_users where id=%s and password=%s and active=%s', (int(uid), passwd, True))
else:
cr.execute('select count(*) from res_users where id=%s and password is null', (int(uid),))
cr.execute('select count(1) from res_users where id=%s and password is null and active=%s', (int(uid), True))
res = cr.fetchone()[0]
cr.close()
if not bool(res):