From 4fe32cf1c6aebd417e1657a1a5ee954e2120b8a3 Mon Sep 17 00:00:00 2001 From: "P. Christeas" Date: Mon, 2 May 2011 12:07:24 +0300 Subject: [PATCH] base_crypt: fix exception, respect res.users active flag After latest Odo's patch, I revisited this code and run base/test_auth.yml against it. In base_crypt we have to check for "active=true", too. bzr revid: p_christ@hol.gr-20110502090724-z077apl03mzaxfqt --- addons/base_crypt/crypt.py | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/addons/base_crypt/crypt.py b/addons/base_crypt/crypt.py index 0b075c3006e..a616b7e5b74 100644 --- a/addons/base_crypt/crypt.py +++ b/addons/base_crypt/crypt.py @@ -41,6 +41,7 @@ from string import ascii_letters, digits from osv import fields,osv import pooler from tools.translate import _ +from service import security magic_md5 = '$1$' @@ -184,7 +185,7 @@ class users(osv.osv): cr.close() def _login(self, cr, db, login, password): - cr.execute( 'SELECT password, id FROM res_users WHERE login=%s', + cr.execute( 'SELECT password, id FROM res_users WHERE login=%s AND active', (login.encode('utf-8'),)) if cr.rowcount: @@ -249,7 +250,7 @@ class users(osv.osv): raise security.ExceptionNoTb('AccessDenied') else: salt = self._salt_cache[db][uid] - cr.execute('SELECT COUNT(*) FROM res_users WHERE id=%s AND password=%s', + cr.execute('SELECT COUNT(*) FROM res_users WHERE id=%s AND password=%s AND active', (int(uid), encrypt_md5(passwd, salt))) res = cr.fetchone()[0] finally: