search

OCA / server-auth

https://odoo-community.org/psc-teams/tools-30
GNU Affero General Public License v3.0
150 stars 403 forks source link

[15.0][FIX] password_security: Fix access error on login #609

Closed fkantelberg closed 2 months ago

fkantelberg commented 7 months ago

Because of [1] Odoo runs into an access error when a password hash will be updated. Previous to the patch the rounds were 25000 and if you login after the patch the same password will be validated and the new one will be updated which will cause Odoo to crash because the user and portal user can't write to the field password_history_ids.

I decided to use sudo because the access handling was already done in super.

Another option would have been to create the res.users.pass.history directly without writing to res.users but portal user don't have the access to that model (only internal users) and I would have to add the security rule.

I added an unittest which is reproducing the error.

[1] https://github.com/OCA/OCB/commit/5502bec830a9442a6c88ac8e4317ecee0519e74e

fkantelberg commented 7 months ago

Closed because I haven't seen #594

JonathanStein commented 7 months ago

Closed because I haven't seen #594

Great, that you made a test case. I think it's easier if you reopen this PR, and I just close mine.

github-actions[bot] commented 3 months ago

There hasn't been any activity on this pull request in the past 4 months, so it has been marked as stale and it will be closed automatically if no further activity occurs in the next 30 days. If you want this PR to never become stale, please ask a PSC member to apply the "no stale" label.