[IMP] auth*: adapt auth_* modules for totp

Prevent non-interactive RPC access when TOTP is enabled, also via
external auth services.

2 files changed, 8 insertions, 4 deletions

diff --git a/addons/auth_ldap/models/res_users.py b/addons/auth_ldap/models/res_users.py
index 29bbb147a8e..a153221763d 100644
--- a/addons/auth_ldap/models/res_users.py
+++ b/addons/auth_ldap/models/res_users.py
@@ -32,7 +32,8 @@ class Users(models.Model):
         try:
             return super(Users, self)._check_credentials(password, env)
         except AccessDenied:
-            if self.env.user.active:
+            passwd_allowed = env['interactive'] or not self.env.user._rpc_api_keys_only()
+            if passwd_allowed and self.env.user.active:
                 Ldap = self.env['res.company.ldap']
                 for conf in Ldap._get_ldap_dicts():
                     if Ldap._authenticate(conf, self.env.user.login, password):
diff --git a/addons/auth_oauth/models/res_users.py b/addons/auth_oauth/models/res_users.py
index 2ee46b6b38c..02a2bd97af8 100644
--- a/addons/auth_oauth/models/res_users.py
+++ b/addons/auth_oauth/models/res_users.py
@@ -113,9 +113,12 @@ class ResUsers(models.Model):
         try:
             return super(ResUsers, self)._check_credentials(password, env)
         except AccessDenied:
-            res = self.sudo().search([('id', '=', self.env.uid), ('oauth_access_token', '=', password)])
-            if not res:
-                raise
+            passwd_allowed = env['interactive'] or not self.env.user._rpc_api_keys_only()
+            if passwd_allowed and self.env.user.active:
+                res = self.sudo().search([('id', '=', self.env.uid), ('oauth_access_token', '=', password)])
+                if res:
+                    return
+            raise
 
     def _get_session_token_fields(self):
         return super(ResUsers, self)._get_session_token_fields() | {'oauth_access_token'}