From 7636d71dfcff09648d080ea4513871a0e27b08ad Mon Sep 17 00:00:00 2001
From: niv-openerp <nicolas.vanhoren@openerp.com>
Date: Fri, 18 Oct 2013 14:57:27 +0200
Subject: [PATCH] [FIX] potential bug in server-side web framework, now forbids
 users to call method when not authentified

bzr revid: nicolas.vanhoren@openerp.com-20131018125727-qtkzkiwkhw4z78kr
---
 addons/web/http.py | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/addons/web/http.py b/addons/web/http.py
index 7e12a71e44a..4bda58117d4 100644
--- a/addons/web/http.py
+++ b/addons/web/http.py
@@ -189,6 +189,8 @@ class WebRequest(object):
 
 def auth_method_user():
     request.uid = request.session.uid
+    if not request.uid:
+        raise SessionExpiredException("Session expired")
 
 def auth_method_admin():
     if not request.db: