Xavier Morel
b3b85cae9b
The changes in `auth_password_policy` are largely the owlification of the password meter widget: - modernize the password policy module and convert it to an odoo-module (note: now exports a pseudo-abstract class which is really a policy, for the sake of somewhat sensibly typing `recommendations`) - replace the implementation of the Meter and PasswordField widgets by owl versions The changes to web and base stem from taking a look at converting the ChangePassword wizard, and finding that it would be a pain in the ass but also... unnecessary? It seems to have been done as a wizard completely in javascript despite being backend-only for legacy reasons: apparently one of the very old web clients (v5 or v6 probably) implemented it as a "native action" which was directly part of the client's UI, and so it had to be implemented entirely in the client. Over time it was moved back into the regular UI (and moved around quite a bit), hooked as a client action to maintain access to the existing UI / dialog. But since it's been an action opened via a button for years it can just... be a normal wizard, with password fields, which auth_password_policy can then set the widget of. So did that: - removed the old unnecessary JS, and its dedicated endpoint (which is *not* used by portal, portal has its own endpoint) - used check_identity for the "old password check" - split out `change_password` with an internal bit so we can have a safer (and logged) "set user password" without needing to provide the old password, which is now used for the bulk password change wizard as well - added a small wizard which just takes a new password (and confirmation), for safety a given change password wizard is only accessible to their creator (also the wizard is restricted to employees though technically it would probably be fine for portal users as well) Rather than extensive messy rewrite / monkeypatching (the original wizard was 57 LOC, though also 22 LOC of template, the auth_policy hooking / patching was 33, plus 8 lines of CSS), `auth_password_policy` just sets the widget of the `new_password` field in the new wizard, much as it did the bulk wizard. Also improve the "hide meter if field is empty" feature by leveraging `:placeholder-shown`. This requires setting a placeholder, and while empty works fine in firefox, it doesn't work in chrome. So the placeholder needs to be a single space. Still, seems better than updating a fake attribute or manipulating a class for the sake of trivial styling. Notes on unlink + transient vacuum Although the wizard object is only created when actually calling `change_password`, and is deleted on success, it is possible for the user to get an error and fail to continue (it should be unlikely without overrides since the passwords are checked while creating / saving but...). While in that case the `new_password` in the database is not the user's own, it could be their *future* password, or give evidence as to their password-creation scheme, or some other signal useful to attack that front of the user's life and behavior. As such, quickly removing leftovers from the database (by setting a very low transient lifetime) seems like a good idea. This is compounded by the `check_identity` having a grace period of 10 minutes. 0.1 is 6 minutes, but because the cron runs every 10 the user effectively has 6~10 minutes between the moment they create an incorrect / incomplete version of the wizard and the moment where it is destroyed if they just leave it. closes odoo/odoo#99458 Signed-off-by: Xavier Morel (xmo) <xmo@odoo.com>
81 lines
3.1 KiB
Python
81 lines
3.1 KiB
Python
# Part of Odoo. See LICENSE file for full copyright and licensing details.
|
|
|
|
import json
|
|
import logging
|
|
import operator
|
|
|
|
from werkzeug.urls import url_encode
|
|
|
|
import odoo
|
|
import odoo.modules.registry
|
|
from odoo import http
|
|
from odoo.modules import module
|
|
from odoo.exceptions import AccessError, UserError, AccessDenied
|
|
from odoo.http import request
|
|
from odoo.service import dispatch_rpc
|
|
from odoo.tools.translate import _
|
|
|
|
|
|
_logger = logging.getLogger(__name__)
|
|
|
|
|
|
class Session(http.Controller):
|
|
|
|
@http.route('/web/session/get_session_info', type='json', auth="user")
|
|
def get_session_info(self):
|
|
# Crapy workaround for unupdatable Odoo Mobile App iOS (Thanks Apple :@)
|
|
request.session.touch()
|
|
return request.env['ir.http'].session_info()
|
|
|
|
@http.route('/web/session/authenticate', type='json', auth="none")
|
|
def authenticate(self, db, login, password, base_location=None):
|
|
if not http.db_filter([db]):
|
|
raise AccessError("Database not found.")
|
|
pre_uid = request.session.authenticate(db, login, password)
|
|
if pre_uid != request.session.uid:
|
|
# Crapy workaround for unupdatable Odoo Mobile App iOS (Thanks Apple :@) and Android
|
|
# Correct behavior should be to raise AccessError("Renewing an expired session for user that has multi-factor-authentication is not supported. Please use /web/login instead.")
|
|
return {'uid': None}
|
|
|
|
request.session.db = db
|
|
registry = odoo.modules.registry.Registry(db)
|
|
with registry.cursor() as cr:
|
|
env = odoo.api.Environment(cr, request.session.uid, request.session.context)
|
|
return env['ir.http'].session_info()
|
|
|
|
@http.route('/web/session/get_lang_list', type='json', auth="none")
|
|
def get_lang_list(self):
|
|
try:
|
|
return dispatch_rpc('db', 'list_lang', []) or []
|
|
except Exception as e:
|
|
return {"error": e, "title": _("Languages")}
|
|
|
|
@http.route('/web/session/modules', type='json', auth="user")
|
|
def modules(self):
|
|
# return all installed modules. Web client is smart enough to not load a module twice
|
|
return list(request.env.registry._init_modules.union([module.current_test] if module.current_test else []))
|
|
|
|
@http.route('/web/session/check', type='json', auth="user")
|
|
def check(self):
|
|
return # ir.http@_authenticate does the job
|
|
|
|
@http.route('/web/session/account', type='json', auth="user")
|
|
def account(self):
|
|
ICP = request.env['ir.config_parameter'].sudo()
|
|
params = {
|
|
'response_type': 'token',
|
|
'client_id': ICP.get_param('database.uuid') or '',
|
|
'state': json.dumps({'d': request.db, 'u': ICP.get_param('web.base.url')}),
|
|
'scope': 'userinfo',
|
|
}
|
|
return 'https://accounts.odoo.com/oauth2/auth?' + url_encode(params)
|
|
|
|
@http.route('/web/session/destroy', type='json', auth="user")
|
|
def destroy(self):
|
|
request.session.logout()
|
|
|
|
@http.route('/web/session/logout', type='http', auth="none")
|
|
def logout(self, redirect='/web'):
|
|
request.session.logout(keep_db=True)
|
|
return request.redirect(redirect, 303)
|