[FIX] web, mail: move admin login warning to mail

Fixes #33254:

* was in mail despite using mail.channel (which breaks if mail is not
  installed, and web doesn't depend on mail)
* changes to sudo() broke previous behaviour (of having odoobot
  message the admin, we ended up with the admin messaging themselves)
  so fix that
* also get the channel and message with the user's context, otherwise
  since we're during the login procedure the context could be as
  little as just the lang from the browser and apparently channel_get
  automatically creates a translation which would break if the
  browser's lang is not installed in Odoo

closes odoo/odoo#37580

Signed-off-by: Xavier Morel (xmo) <xmo@odoo.com>

2 files changed, 39 insertions, 0 deletions

diff --git a/addons/mail/controllers/__init__.py b/addons/mail/controllers/__init__.py
index 48f637f49a7..733774e9800 100644
--- a/addons/mail/controllers/__init__.py
+++ b/addons/mail/controllers/__init__.py
@@ -1,3 +1,4 @@
 # -*- coding: utf-8 -*
 from . import main
 from . import bus
+from . import home
diff --git a/addons/mail/controllers/home.py b/addons/mail/controllers/home.py
new file mode 100644
index 00000000000..ff5397ef9eb
--- /dev/null
+++ b/addons/mail/controllers/home.py
@@ -0,0 +1,38 @@
+# -*- coding: utf-8 -*-
+import ipaddress
+
+from odoo import _, SUPERUSER_ID
+from odoo.http import request
+from odoo.addons.web.controllers import main as web
+
+def _admin_password_warn(uid):
+    """ Admin still has `admin` password, flash a message via chatter.
+
+    Uses a private mail.channel from the system (/ odoobot) to the user, as
+    using a more generic mail.thread could send an email which is undesirable
+
+    Uses mail.channel directly because using mail.thread might send an email instead.
+    """
+    if request.params['password'] != 'admin':
+        return
+    if ipaddress.ip_address(request.httprequest.remote_addr).is_private:
+        return
+    admin = request.env.ref('base.partner_admin')
+    if uid not in admin.user_ids.ids:
+        return
+
+    user = request.env(user=uid)['res.users']
+    MailChannel = request.env(user=SUPERUSER_ID, context=user.context_get(), su=True)['mail.channel']
+    MailChannel.browse(MailChannel.channel_get([admin.id])['id'])\
+        .message_post(
+            body=_("Your password is the default (admin)! If this system is exposed to untrusted users it is important to change it immediately for security reasons. I will keep nagging you about it!"),
+            message_type='comment',
+            subtype='mail.mt_comment'
+        )
+
+class Home(web.Home):
+    def _login_redirect(self, uid, redirect):
+        if request.params.get('login_success'):
+            _admin_password_warn(uid)
+
+        return super()._login_redirect(uid, redirect)