diff options
| author | P. Christeas <p_christ@hol.gr> | 2011-05-02 12:07:24 +0300 |
|---|---|---|
| committer | P. Christeas <p_christ@hol.gr> | 2011-05-02 12:07:24 +0300 |
| commit | 4fe32cf1c6aebd417e1657a1a5ee954e2120b8a3 (patch) | |
| tree | ac1a8fbfe58457ba14931746c3255dcb190156d6 /addons/base_crypt | |
| parent | 4eb213855e33f78d4feb211e97f2a51ba2b5ecbe (diff) | |
base_crypt: fix exception, respect res.users active flag
After latest Odo's patch, I revisited this code and run base/test_auth.yml
against it. In base_crypt we have to check for "active=true", too.
bzr revid: p_christ@hol.gr-20110502090724-z077apl03mzaxfqt
Diffstat (limited to 'addons/base_crypt')
| -rw-r--r-- | addons/base_crypt/crypt.py | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/addons/base_crypt/crypt.py b/addons/base_crypt/crypt.py index 0b075c3006e..a616b7e5b74 100644 --- a/addons/base_crypt/crypt.py +++ b/addons/base_crypt/crypt.py @@ -41,6 +41,7 @@ from string import ascii_letters, digits from osv import fields,osv import pooler from tools.translate import _ +from service import security magic_md5 = '$1$' @@ -184,7 +185,7 @@ class users(osv.osv): cr.close() def _login(self, cr, db, login, password): - cr.execute( 'SELECT password, id FROM res_users WHERE login=%s', + cr.execute( 'SELECT password, id FROM res_users WHERE login=%s AND active', (login.encode('utf-8'),)) if cr.rowcount: @@ -249,7 +250,7 @@ class users(osv.osv): raise security.ExceptionNoTb('AccessDenied') else: salt = self._salt_cache[db][uid] - cr.execute('SELECT COUNT(*) FROM res_users WHERE id=%s AND password=%s', + cr.execute('SELECT COUNT(*) FROM res_users WHERE id=%s AND password=%s AND active', (int(uid), encrypt_md5(passwd, salt))) res = cr.fetchone()[0] finally: |