[FIX] web, mail: move admin login warning to mail

Fixes #33254:

* was in mail despite using mail.channel (which breaks if mail is not
  installed, and web doesn't depend on mail)
* changes to sudo() broke previous behaviour (of having odoobot
  message the admin, we ended up with the admin messaging themselves)
  so fix that
* also get the channel and message with the user's context, otherwise
  since we're during the login procedure the context could be as
  little as just the lang from the browser and apparently channel_get
  automatically creates a translation which would break if the
  browser's lang is not installed in Odoo

closes odoo/odoo#37580

Signed-off-by: Xavier Morel (xmo) <xmo@odoo.com>

1 files changed, 0 insertions, 27 deletions

diff --git a/addons/web/controllers/main.py b/addons/web/controllers/main.py
index ade8e40a270..c80dbd17da4 100644
--- a/addons/web/controllers/main.py
+++ b/addons/web/controllers/main.py
@@ -9,7 +9,6 @@ import functools
 import glob
 import hashlib
 import io
-import ipaddress
 import itertools
 import jinja2
 import json
@@ -394,31 +393,6 @@ def xml2json_from_elementtree(el, preserve_whitespaces=False):
     res["children"] = kids
     return res
 
-def _admin_password_warn(uid):
-    """ Admin still has `admin` password, flash a message via chatter.
-
-    Uses a private mail.channel from the system (/ odoobot) to the user, as
-    using a more generic mail.thread could send an email which is undesirable
-
-    Uses mail.channel directly because using mail.thread might send an email instead.
-    """
-    if request.params['password'] != 'admin':
-        return
-    if ipaddress.ip_address(request.httprequest.remote_addr).is_private:
-        return
-    admin = request.env.ref('base.partner_admin')
-    if uid not in admin.user_ids.ids:
-        return
-
-    MailChannel = request.env['mail.channel'].sudo()
-    MailChannel.browse(MailChannel.channel_get([admin.id])['id'])\
-        .message_post(
-            body=_("Your password is the default (admin)! If this system is exposed to untrusted users it is important to change it immediately for security reasons. I will keep nagging you about it!"),
-            message_type='comment',
-            subtype='mail.mt_comment'
-        )
-
-
 class HomeStaticTemplateHelpers(object):
     """
     Helper Class that wraps the reading of static qweb templates files
@@ -836,7 +810,6 @@ class Home(http.Controller):
             old_uid = request.uid
             try:
                 uid = request.session.authenticate(request.session.db, request.params['login'], request.params['password'])
-                _admin_password_warn(uid)
                 request.params['login_success'] = True
                 return http.redirect_with_hash(self._login_redirect(uid, redirect=redirect))
             except odoo.exceptions.AccessDenied as e: