From 6639630de11e5e3b4046968f8981415d6ccca6cd Mon Sep 17 00:00:00 2001 From: Denis Roussel Date: Tue, 27 Nov 2018 10:14:43 +0100 Subject: [PATCH] [FIX] base: make check_credentials more consistent with alternatives The other methods do test password length before verifying it, so even if check_credentials() is not meant to be called directly, it's better to keep it consistent with the alternatives. Closes #29023 --- odoo/addons/base/res/res_users.py | 2 ++ 1 file changed, 2 insertions(+) diff --git a/odoo/addons/base/res/res_users.py b/odoo/addons/base/res/res_users.py index 866ab65ec85..8c7194d4279 100644 --- a/odoo/addons/base/res/res_users.py +++ b/odoo/addons/base/res/res_users.py @@ -444,6 +444,8 @@ class Users(models.Model): @api.model def check_credentials(self, password): """ Override this method to plug additional authentication methods""" + if not password: + raise AccessDenied() user = self.sudo().search([('id', '=', self._uid), ('password', '=', password)]) if not user: raise AccessDenied()