search

OCA / server-auth

https://odoo-community.org/psc-teams/tools-30
GNU Affero General Public License v3.0
150 stars 403 forks source link

[15.0][FIX] password_security: Allow password hash updates #594

Closed JonathanStein closed 7 months ago

JonathanStein commented 8 months ago

Updating the password hash fails, if "_set_encrypted_password" is called as a regular user.

The core _set_encrypted_password method executes a direct query without any access checks, so we assume it's safe to operate with sudo() here.

The problem was seen after https://github.com/odoo/odoo/pull/146865 where hash strength is increased, resulting in password hash updates without a normal password change.

JonathanStein commented 7 months ago

Closing this PR because https://github.com/OCA/server-auth/pull/609 has the same fix but also includes test code