Xavier Morel
a8d868e287
Task 31122 section 4. Implement per-IP rate limiting of login attempts after some number of failures. * check_credentials has no reason to be public, make it private * add hooks to check for login cooldown on a source IP (remote_addr: http://werkzeug.pocoo.org/docs/0.14/wrappers/#werkzeug.wrappers.BaseRequest.remote_addr) basis * add baseline/default configuration of 60s cooldown * add baseline threshold of 10 login failures, after checking odoo.com logs it looks like we have short runs of up to 7 failures (assumed to be legitimate) before the user either gets it right or goes and looks it up Depends on #24187
42 lines
1.4 KiB
Python
42 lines
1.4 KiB
Python
# -*- coding: utf-8 -*-
|
|
# Part of Odoo. See LICENSE file for full copyright and licensing details.
|
|
|
|
from odoo.exceptions import AccessDenied
|
|
|
|
from odoo import api, models, registry, SUPERUSER_ID
|
|
|
|
|
|
class Users(models.Model):
|
|
_inherit = "res.users"
|
|
|
|
@classmethod
|
|
def _login(cls, db, login, password):
|
|
user_id = super(Users, cls)._login(db, login, password)
|
|
if user_id:
|
|
return user_id
|
|
with registry(db).cursor() as cr:
|
|
cr.execute("SELECT id FROM res_users WHERE lower(login)=%s", (login,))
|
|
res = cr.fetchone()
|
|
if res:
|
|
return False
|
|
env = api.Environment(cr, SUPERUSER_ID, {})
|
|
Ldap = env['res.company.ldap']
|
|
for conf in Ldap.get_ldap_dicts():
|
|
entry = Ldap.authenticate(conf, login, password)
|
|
if entry:
|
|
user_id = Ldap.get_or_create_user(conf, login, entry)
|
|
if user_id:
|
|
break
|
|
return user_id
|
|
|
|
def _check_credentials(self, password):
|
|
try:
|
|
super(Users, self)._check_credentials(password)
|
|
except AccessDenied:
|
|
if self.env.user.active:
|
|
Ldap = self.env['res.company.ldap']
|
|
for conf in Ldap.get_ldap_dicts():
|
|
if Ldap.authenticate(conf, self.env.user.login, password):
|
|
return
|
|
raise
|