From e0a62de1ad7cfce1ae3e06a414982d41cb5af585 Mon Sep 17 00:00:00 2001 From: Christophe Simonis Date: Thu, 13 Aug 2009 13:06:43 +0200 Subject: [PATCH 1/2] [FIX] avoid a bug when look in stack when translate code strings bzr revid: christophe@tinyerp.com-20090813110643-9y2wgb6omp6odjsz --- bin/tools/translate.py | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/bin/tools/translate.py b/bin/tools/translate.py index 2e46f6ecfce..736afdf8446 100644 --- a/bin/tools/translate.py +++ b/bin/tools/translate.py @@ -125,7 +125,11 @@ def translate(cr, name, source_type, lang, source=None): class GettextAlias(object): def __call__(self, source): - frame = inspect.stack()[1][0] + try: + frame = inspect.stack()[1][0] + except: + return source + cr = frame.f_locals.get('cr') lang = (frame.f_locals.get('context') or {}).get('lang', False) if not (lang and cr): From 06c062e6cfebdc2426dacdb13cea399e29aa3903 Mon Sep 17 00:00:00 2001 From: Christophe Simonis Date: Thu, 13 Aug 2009 13:12:24 +0200 Subject: [PATCH 2/2] [FIX] security issue: avoid access to inactive users [FIX] security issue: avoid access with 'None' password (Thanks to P. Christeas for the bug report) bzr revid: christophe@tinyerp.com-20090813111224-f05a3z5i0wvewy85 --- bin/service/security.py | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/bin/service/security.py b/bin/service/security.py index 3a4c3c80f61..5c9e91975c7 100644 --- a/bin/service/security.py +++ b/bin/service/security.py @@ -45,13 +45,14 @@ def check_super(passwd): raise Exception('AccessDenied') def check(db, uid, passwd): - if _uid_cache.get(db, {}).get(uid) == passwd: + cached_pass = _uid_cache.get(db, {}).get(uid) + if (cached_pass is not None) and cached_pass == passwd: return True cr = pooler.get_db(db).cursor() if passwd: - cr.execute('select count(*) from res_users where id=%s and password=%s', (int(uid), passwd)) + cr.execute('select count(1) from res_users where id=%s and password=%s and active=%s', (int(uid), passwd, True)) else: - cr.execute('select count(*) from res_users where id=%s and password is null', (int(uid),)) + cr.execute('select count(1) from res_users where id=%s and password is null and active=%s', (int(uid), True)) res = cr.fetchone()[0] cr.close() if not bool(res):