From 59f6cc2b09f35976527ed0929a7edcd12cbccc7e Mon Sep 17 00:00:00 2001
From: Olivier Dony <odo@openerp.com>
Date: Thu, 28 Apr 2011 17:51:11 +0200
Subject: [PATCH] [FIX] base_crypt: double-check to prevent blank passwords

bzr revid: odo@openerp.com-20110428155111-ut91pv47u7blya3q
---
 addons/base_crypt/crypt.py | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/addons/base_crypt/crypt.py b/addons/base_crypt/crypt.py
index 9f437ace9fc..0b075c3006e 100644
--- a/addons/base_crypt/crypt.py
+++ b/addons/base_crypt/crypt.py
@@ -220,6 +220,10 @@ class users(osv.osv):
             return False
 
     def check(self, db, uid, passwd):
+        if not passwd:
+            # empty passwords disallowed for obvious security reasons
+            raise security.ExceptionNoTb('AccessDenied')
+
         # Get a chance to hash all passwords in db before using the uid_cache.
         obj = pooler.get_pool(db).get('res.users')
         if not hasattr(obj, "_salt_cache"):