From c3addfc94aa287455de123c6546cdfecc5433372 Mon Sep 17 00:00:00 2001 From: Xavier Morel Date: Wed, 19 Aug 2020 06:06:23 +0000 Subject: [PATCH] [FIX] core: position of finalization when authenticating Missed while merging the 2FA: in a mono-db scenario, the request is bound to a database more or less immediately; however in a multi-db scenario the current request *may* not be bound to a database by the time we reach session authentication, this binding is performed *by* the authentication step[0]. By trying to access an environment (requiring a db) before this binding is performed, the authentication procedure broke. We could create the environment by hand, but it seems completely unnecessary: while there is a bundle of operations to perform in all cases and a bundle to perform during finalization, they don't seem to strictly depend on one another (and indeed this separation is already a reordering of the operations from before), so the finalization can be performed *after* having bound the current session to a database. In fact that is closer to the older order: in the pre-totp iteration, only the binding of the uid was performed before that of the login, and even it was done after binding the database. [0] this really is mostly a concern when using this step programmatically, as interactively the database selector should require selecting (and binding) a database before it's possible to log-in closes odoo/odoo#56093 Signed-off-by: Xavier Morel (xmo) --- odoo/http.py | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/odoo/http.py b/odoo/http.py index b794dce36f8..872fe0548d9 100644 --- a/odoo/http.py +++ b/odoo/http.py @@ -992,15 +992,15 @@ class OpenERPSession(sessions.Session): uid = odoo.registry(db)['res.users'].authenticate(db, login, password, env) self.pre_uid = uid - user = request.env(user=uid)['res.users'].browse(uid) - if not user._mfa_url(): - self.finalize() - self.rotate = True self.db = db self.login = login request.disable_db = False + user = request.env(user=uid)['res.users'].browse(uid) + if not user._mfa_url(): + self.finalize() + return uid def finalize(self):