From efb516e045031ccc576fa5c0e4f03d6967538a9d Mon Sep 17 00:00:00 2001
From: Xavier Morel <xmo@odoo.com>
Date: Tue, 2 Oct 2018 20:32:40 +0200
Subject: [PATCH] [ADD] auth_password_policy

Hard-checks password length according to configured rule (default: at
least 8 characters).

Closes #22351
---
 addons/auth_password_policy/__init__.py       |  1 +
 addons/auth_password_policy/__manifest__.py   |  6 +++++
 .../auth_password_policy/models/__init__.py   |  2 ++
 .../models/res_config_settings.py             | 27 +++++++++++++++++++
 .../auth_password_policy/models/res_users.py  | 26 ++++++++++++++++++
 .../views/res_config_settings_views.xml       | 19 +++++++++++++
 6 files changed, 81 insertions(+)
 create mode 100644 addons/auth_password_policy/__init__.py
 create mode 100644 addons/auth_password_policy/__manifest__.py
 create mode 100644 addons/auth_password_policy/models/__init__.py
 create mode 100644 addons/auth_password_policy/models/res_config_settings.py
 create mode 100644 addons/auth_password_policy/models/res_users.py
 create mode 100644 addons/auth_password_policy/views/res_config_settings_views.xml

diff --git a/addons/auth_password_policy/__init__.py b/addons/auth_password_policy/__init__.py
new file mode 100644
index 00000000000..0650744f6bc
--- /dev/null
+++ b/addons/auth_password_policy/__init__.py
@@ -0,0 +1 @@
+from . import models
diff --git a/addons/auth_password_policy/__manifest__.py b/addons/auth_password_policy/__manifest__.py
new file mode 100644
index 00000000000..ca7f49b8cfb
--- /dev/null
+++ b/addons/auth_password_policy/__manifest__.py
@@ -0,0 +1,6 @@
+{
+    'name': "Password Policy",
+    "summary": "Implements basic password policy configuration & check",
+    'depends': ['base_setup', 'auth_crypt'],
+    'data': ['views/res_config_settings_views.xml']
+}
diff --git a/addons/auth_password_policy/models/__init__.py b/addons/auth_password_policy/models/__init__.py
new file mode 100644
index 00000000000..ef6d50929f3
--- /dev/null
+++ b/addons/auth_password_policy/models/__init__.py
@@ -0,0 +1,2 @@
+from . import res_config_settings
+from . import res_users
diff --git a/addons/auth_password_policy/models/res_config_settings.py b/addons/auth_password_policy/models/res_config_settings.py
new file mode 100644
index 00000000000..d4f0d2c7702
--- /dev/null
+++ b/addons/auth_password_policy/models/res_config_settings.py
@@ -0,0 +1,27 @@
+from odoo import api, fields, models, _
+
+
+class ResConfigSettings(models.TransientModel):
+    _inherit = 'res.config.settings'
+
+    minlength = fields.Integer("Minimum Length", help="Minimum number of characters passwords must contain.")
+
+    @api.model
+    def get_values(self):
+        res = super(ResConfigSettings, self).get_values()
+
+        res['minlength'] = int(self.env['ir.config_parameter'].sudo().get_param('auth_password_policy.minlength', default=0))
+
+        return res
+
+    @api.model
+    def set_values(self):
+        self.env['ir.config_parameter'].sudo().set_param('auth_password_policy.minlength', self.minlength)
+
+        super(ResConfigSettings, self).set_values()
+
+    @api.onchange('minlength')
+    def _on_change_mins(self):
+        """ Password lower bounds must be naturals
+        """
+        self.minlength = max(0, self.minlength or 0)
diff --git a/addons/auth_password_policy/models/res_users.py b/addons/auth_password_policy/models/res_users.py
new file mode 100644
index 00000000000..c44c4673f4b
--- /dev/null
+++ b/addons/auth_password_policy/models/res_users.py
@@ -0,0 +1,26 @@
+# -*- coding: utf-8 -*-
+from odoo import api, models, _
+from odoo.exceptions import UserError
+
+
+class ResUsers(models.Model):
+    _inherit = 'res.users'
+
+    def _set_password(self):
+        self._check_password_policy(self.mapped('password'))
+
+        super(ResUsers, self)._set_password()
+
+    def _check_password_policy(self, passwords):
+        failures = []
+        params = self.env['ir.config_parameter'].sudo()
+
+        minlength = int(params.get_param('auth_password_policy.minlength', default=0))
+        for password in passwords:
+            if not password:
+                continue
+            if len(password) < minlength:
+                failures.append(_(u"Passwords must have at least %d characters, got %d.") % (minlength, len(password)))
+
+        if failures:
+            raise UserError(u'\n\n '.join(failures))
diff --git a/addons/auth_password_policy/views/res_config_settings_views.xml b/addons/auth_password_policy/views/res_config_settings_views.xml
new file mode 100644
index 00000000000..a4a1cbf1c88
--- /dev/null
+++ b/addons/auth_password_policy/views/res_config_settings_views.xml
@@ -0,0 +1,19 @@
+<odoo>
+    <record id="res_config_settings_view_form" model="ir.ui.view">
+        <field name="name">res.config.settings.form.auth_password_policy</field>
+        <field name="model">res.config.settings</field>
+        <field name="inherit_id" ref="base_setup.res_config_settings_view_form"/>
+        <field name="arch" type="xml">
+            <!-- add before the Access Rights section -->
+            <xpath expr="//div[@id='access_rights']" position="before">
+                <div class="col-12 col-lg-6 o_setting_box">
+                    <div class="o_setting_left_pane"/>
+                    <div class="o_setting_right_pane">
+                        <label for="minlength"/>
+                        <field name="minlength"/>
+                    </div>
+                </div>
+            </xpath>
+        </field>
+    </record>
+</odoo>