diff options
| author | Martin Trigaux <mat@odoo.com> | 2018-07-09 14:59:11 +0200 |
|---|---|---|
| committer | Christophe Simonis <chs@odoo.com> | 2018-07-10 16:03:23 +0200 |
| commit | 00a55f4428bf72f5e9e2ff4b4028090b6321cf4a (patch) | |
| tree | d2a17c7043d8d1d4641eee16d1014b0b84fc0a3d /doc | |
| parent | 8b25099aea6345c711eaff1d3363c47020653f99 (diff) | |
[FIX] service: properly invalidate session of deteled users
If a user A deletes the res.users record of user B while B is connected,
the verification of the session token fails with a comparison of a boolean and
bytes values.
While the check should obviously fail, this patch gracefully inform the user B
its session has expired and redirect him to the login page.
Without the patch, the session is never invalidated in the user browser,
redirecting to a forbidden error page as long as the session has not been manually
cleared from the browser.
Fixes #25530
Closes #25654
Closes #25682
Cherry-Pick of 96f01c08f8cd15cd572333fafed4456e4f6ef88a
Diffstat (limited to 'doc')
0 files changed, 0 insertions, 0 deletions