From b334dfcbd20d8554a763308ec5713bd1b97a6d66 Mon Sep 17 00:00:00 2001 From: Martin Trigaux Date: Thu, 31 Oct 2019 15:18:01 +0000 Subject: [PATCH] [IMP] web: force a master password on insecure dbs When creating a new database, a random master password for it is generated and strongly suggested to be used. The motivation for this change is to have, by default, a secure master password set for any Odoo deployment. Often, users do not realise that, when making an Odoo installation accessible on internet, anyone else can also access it. Use autocomplete="new-password" for updating the master password and play nice with password managers When generating a new password, use autocomplete="new-password" as well to prevent autofill of password potentially saved in password manager. Make the eye click to toogle on click instead of need to maintain. closes odoo/odoo#45117 Task-id: 2091260 Signed-off-by: Martin Trigaux (mat) --- addons/web/controllers/main.py | 15 +++++ addons/web/views/database_manager.html | 88 ++++++++++++++++++++------ 2 files changed, 83 insertions(+), 20 deletions(-) diff --git a/addons/web/controllers/main.py b/addons/web/controllers/main.py index 971181d14a1..97f1f1a1735 100644 --- a/addons/web/controllers/main.py +++ b/addons/web/controllers/main.py @@ -1085,6 +1085,9 @@ class Database(http.Controller): @http.route('/web/database/create', type='http', auth="none", methods=['POST'], csrf=False) def create(self, master_pwd, name, lang, password, **post): + insecure = odoo.tools.config.verify_admin_password('admin') + if insecure and master_pwd: + dispatch_rpc('db', 'change_admin_password', ["admin", master_pwd]) try: if not re.match(DBNAME_PATTERN, name): raise Exception(_('Invalid database name. Only alphanumerical characters, underscore, hyphen and dot are allowed.')) @@ -1099,6 +1102,9 @@ class Database(http.Controller): @http.route('/web/database/duplicate', type='http', auth="none", methods=['POST'], csrf=False) def duplicate(self, master_pwd, name, new_name): + insecure = odoo.tools.config.verify_admin_password('admin') + if insecure and master_pwd: + dispatch_rpc('db', 'change_admin_password', ["admin", master_pwd]) try: if not re.match(DBNAME_PATTERN, new_name): raise Exception(_('Invalid database name. Only alphanumerical characters, underscore, hyphen and dot are allowed.')) @@ -1111,6 +1117,9 @@ class Database(http.Controller): @http.route('/web/database/drop', type='http', auth="none", methods=['POST'], csrf=False) def drop(self, master_pwd, name): + insecure = odoo.tools.config.verify_admin_password('admin') + if insecure and master_pwd: + dispatch_rpc('db', 'change_admin_password', ["admin", master_pwd]) try: dispatch_rpc('db','drop', [master_pwd, name]) request._cr = None # dropping a database leads to an unusable cursor @@ -1121,6 +1130,9 @@ class Database(http.Controller): @http.route('/web/database/backup', type='http', auth="none", methods=['POST'], csrf=False) def backup(self, master_pwd, name, backup_format = 'zip'): + insecure = odoo.tools.config.verify_admin_password('admin') + if insecure and master_pwd: + dispatch_rpc('db', 'change_admin_password', ["admin", master_pwd]) try: odoo.service.db.check_super(master_pwd) ts = datetime.datetime.utcnow().strftime("%Y-%m-%d_%H-%M-%S") @@ -1139,6 +1151,9 @@ class Database(http.Controller): @http.route('/web/database/restore', type='http', auth="none", methods=['POST'], csrf=False) def restore(self, master_pwd, backup_file, name, copy=False): + insecure = odoo.tools.config.verify_admin_password('admin') + if insecure and master_pwd: + dispatch_rpc('db', 'change_admin_password', ["admin", master_pwd]) try: data_file = None db.check_super(master_pwd) diff --git a/addons/web/views/database_manager.html b/addons/web/views/database_manager.html index 4649366dd61..8d0d660ceb2 100644 --- a/addons/web/views/database_manager.html +++ b/addons/web/views/database_manager.html @@ -28,8 +28,10 @@ - {% macro master_input() -%} -
- {% if insecure %} + {% macro master_input(set_master_pwd=False) -%} + + {% set input_class = "form-control" %} + {% if insecure %} + {% if set_master_pwd %} {% else %} - - +
+

Warning, your Odoo database manager is not protected. To secure it, we have generated the following master password for it:

+

+

You can change it below but be sure to remember it, it will be asked for future operations on databases.

+
+ {% set input_class = "form-control generated_master_pwd_input" %} {% endif %} -
+ {% endif %} + {% if not insecure or not set_master_pwd %} +
+ +
+ +
+ +
+
+
+ {% endif %} {%- endmacro %} {% macro create_form() -%} @@ -73,7 +117,7 @@
- +
@@ -225,13 +269,17 @@
{{ master_input() }} -
- - +
+ +
+ +
-
- - +
+ +
+ +
@@ -268,11 +316,11 @@

The master password is required to create, delete, dump or restore databases.

- {{ master_input() }} + {{ master_input(set_master_pwd=True) }}
- +
@@ -300,7 +348,7 @@ {{ master_input() }}
- +
@@ -328,7 +376,7 @@ {{ master_input() }}
- +
@@ -352,7 +400,7 @@ {{ master_input() }}
- +