[IMP] auth*: adapt auth_* modules for totp

Prevent non-interactive RPC access when TOTP is enabled, also via external auth services.
2020-08-14 23:06:25 +00:00
parent a9a6509713
commit 7cf64c2173
2 changed files with 8 additions and 4 deletions
@@ -32,7 +32,8 @@ class Users(models.Model):
        try:
            return super(Users, self)._check_credentials(password, env)
        except AccessDenied:
-            if self.env.user.active:
+            passwd_allowed = env['interactive'] or not self.env.user._rpc_api_keys_only()
+            if passwd_allowed and self.env.user.active:
                Ldap = self.env['res.company.ldap']
                for conf in Ldap._get_ldap_dicts():
                    if Ldap._authenticate(conf, self.env.user.login, password):