base_crypt: fix exception, respect res.users active flag
After latest Odo's patch, I revisited this code and run base/test_auth.yml against it. In base_crypt we have to check for "active=true", too. bzr revid: p_christ@hol.gr-20110502090724-z077apl03mzaxfqt
This commit is contained in:
@@ -41,6 +41,7 @@ from string import ascii_letters, digits
|
||||
from osv import fields,osv
|
||||
import pooler
|
||||
from tools.translate import _
|
||||
from service import security
|
||||
|
||||
magic_md5 = '$1$'
|
||||
|
||||
@@ -184,7 +185,7 @@ class users(osv.osv):
|
||||
cr.close()
|
||||
|
||||
def _login(self, cr, db, login, password):
|
||||
cr.execute( 'SELECT password, id FROM res_users WHERE login=%s',
|
||||
cr.execute( 'SELECT password, id FROM res_users WHERE login=%s AND active',
|
||||
(login.encode('utf-8'),))
|
||||
|
||||
if cr.rowcount:
|
||||
@@ -249,7 +250,7 @@ class users(osv.osv):
|
||||
raise security.ExceptionNoTb('AccessDenied')
|
||||
else:
|
||||
salt = self._salt_cache[db][uid]
|
||||
cr.execute('SELECT COUNT(*) FROM res_users WHERE id=%s AND password=%s',
|
||||
cr.execute('SELECT COUNT(*) FROM res_users WHERE id=%s AND password=%s AND active',
|
||||
(int(uid), encrypt_md5(passwd, salt)))
|
||||
res = cr.fetchone()[0]
|
||||
finally:
|
||||
|
||||
Reference in New Issue
Block a user