Olivier Dony
d05c813653
The point is to warn admins of production and public-facing databases. However it is not necessary to nag users of demo databases, even when connecting non-locally (e.g. on runbot). Updates #37580 (manual) forward-port of #48689 closes odoo/odoo#48691 Signed-off-by: Olivier Dony (odo) <odo@openerp.com>
42 lines
1.6 KiB
Python
42 lines
1.6 KiB
Python
# -*- coding: utf-8 -*-
|
|
import ipaddress
|
|
|
|
from odoo import _, SUPERUSER_ID
|
|
from odoo.http import request
|
|
from odoo.addons.web.controllers import main as web
|
|
|
|
def _admin_password_warn(uid):
|
|
""" Admin still has `admin` password, flash a message via chatter.
|
|
|
|
Uses a private mail.channel from the system (/ odoobot) to the user, as
|
|
using a more generic mail.thread could send an email which is undesirable
|
|
|
|
Uses mail.channel directly because using mail.thread might send an email instead.
|
|
"""
|
|
if request.params['password'] != 'admin':
|
|
return
|
|
if ipaddress.ip_address(request.httprequest.remote_addr).is_private:
|
|
return
|
|
admin = request.env.ref('base.partner_admin')
|
|
if uid not in admin.user_ids.ids:
|
|
return
|
|
has_demo = bool(request.env['ir.module.module'].sudo().search_count([('demo', '=', True)]))
|
|
if has_demo:
|
|
return
|
|
|
|
user = request.env(user=uid)['res.users']
|
|
MailChannel = request.env(user=SUPERUSER_ID, context=user.context_get(), su=True)['mail.channel']
|
|
MailChannel.browse(MailChannel.channel_get([admin.id])['id'])\
|
|
.message_post(
|
|
body=_("Your password is the default (admin)! If this system is exposed to untrusted users it is important to change it immediately for security reasons. I will keep nagging you about it!"),
|
|
message_type='comment',
|
|
subtype_xmlid='mail.mt_comment'
|
|
)
|
|
|
|
class Home(web.Home):
|
|
def _login_redirect(self, uid, redirect=None):
|
|
if request.params.get('login_success'):
|
|
_admin_password_warn(uid)
|
|
|
|
return super()._login_redirect(uid, redirect)
|