[IMP] auth*: adapt auth_* modules for totp

Prevent non-interactive RPC access when TOTP is enabled, also via
external auth services.

1 files changed, 6 insertions, 3 deletions

diff --git a/addons/auth_oauth/models/res_users.py b/addons/auth_oauth/models/res_users.py
index 2ee46b6b38c..02a2bd97af8 100644
--- a/addons/auth_oauth/models/res_users.py
+++ b/addons/auth_oauth/models/res_users.py
@@ -113,9 +113,12 @@ class ResUsers(models.Model):
         try:
             return super(ResUsers, self)._check_credentials(password, env)
         except AccessDenied:
-            res = self.sudo().search([('id', '=', self.env.uid), ('oauth_access_token', '=', password)])
-            if not res:
-                raise
+            passwd_allowed = env['interactive'] or not self.env.user._rpc_api_keys_only()
+            if passwd_allowed and self.env.user.active:
+                res = self.sudo().search([('id', '=', self.env.uid), ('oauth_access_token', '=', password)])
+                if res:
+                    return
+            raise
 
     def _get_session_token_fields(self):
         return super(ResUsers, self)._get_session_token_fields() | {'oauth_access_token'}