From 1f1da0508d84d507682853a9184bc67a5125fef2 Mon Sep 17 00:00:00 2001 From: Xavier Morel Date: Thu, 14 Jan 2021 10:08:00 +0000 Subject: [PATCH] [IMP] base: properly handle API keys on inactive users closes odoo/odoo#66512 X-original-commit: baebf5814425cce6a9481b4efec5248bbba3ea64 Signed-off-by: Olivier Dony (odo) Signed-off-by: Xavier Morel (xmo) --- odoo/addons/base/models/res_users.py | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/odoo/addons/base/models/res_users.py b/odoo/addons/base/models/res_users.py index e01abae68c2..fff28a5a618 100644 --- a/odoo/addons/base/models/res_users.py +++ b/odoo/addons/base/models/res_users.py @@ -1643,7 +1643,11 @@ class APIKeys(models.Model): def _check_credentials(self, *, scope, key): assert scope, "scope is required" index = key[:INDEX_SIZE] - self.env.cr.execute('SELECT user_id, key FROM res_users_apikeys WHERE index = %s AND (scope IS NULL OR scope = %s)', [index, scope]) + self.env.cr.execute(''' + SELECT user_id, key + FROM res_users_apikeys INNER JOIN res_users u ON (u.id = user_id) + WHERE u.active and index = %s AND (scope IS NULL OR scope = %s) + ''', [index, scope]) for user_id, current_key in self.env.cr.fetchall(): if KEY_CRYPT_CONTEXT.verify(key, current_key): return user_id