diff options
| author | Xavier Morel <xmo@odoo.com> | 2020-08-19 13:19:57 +0000 |
|---|---|---|
| committer | Xavier Morel <xmo@odoo.com> | 2020-09-10 12:50:19 +0000 |
| commit | 3fc9b40561af001fac6914ec56f12d433e012b2a (patch) | |
| tree | 7a4d21a4df4f04f821ed03a379355ecc6ff1f27e /addons | |
| parent | 452f4eabaef725ba8cfbaa4e1202529ab7a4096f (diff) | |
[FIX] auth_totp: session update after enabling or disabling totp
bfcc7dee8f40afb5f7dec4e2cf5a669c0682e2ed tried to fix the session
disconnection issue, but the fix only worked in single-process (either
threaded or workers=1): because the cache was cleared but the update
not flushed, since `_compute_session_token` uses SQL directly it would
recompute the old session_token which it would cache, and thus the
process would carry-on with the old token just re-set in the session
and cache.
Meanwhile in multi-process, odds are good that the next request will
be on a different worker which *will* see the change, and will
immediately complain & destroy the session.
Add the missing flush calls right before recomputing the session token
so the SQL "sees" the correct state.
Diffstat (limited to 'addons')
| -rw-r--r-- | addons/auth_totp/models/res_users.py | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/addons/auth_totp/models/res_users.py b/addons/auth_totp/models/res_users.py index 855a92e0f35..06aad891550 100644 --- a/addons/auth_totp/models/res_users.py +++ b/addons/auth_totp/models/res_users.py @@ -68,6 +68,7 @@ class Users(models.Model): self.sudo().totp_secret = secret if request: + self.flush() # update session token so the user does not get logged out (cache cleared by change) new_token = self.env.user._compute_session_token(request.session.sid) request.session.session_token = new_token @@ -83,6 +84,7 @@ class Users(models.Model): self.sudo().write({'totp_secret': False}) if request and self == self.env.user: + self.flush() # update session token so the user does not get logged out (cache cleared by change) new_token = self.env.user._compute_session_token(request.session.sid) request.session.session_token = new_token |