diff options
| author | Xavier Morel <xmo@odoo.com> | 2021-01-14 10:08:00 +0000 |
|---|---|---|
| committer | Xavier Morel <xmo@odoo.com> | 2021-02-18 10:33:28 +0000 |
| commit | baebf5814425cce6a9481b4efec5248bbba3ea64 (patch) | |
| tree | 274c000db024efa247613129b9c474e64daad128 /odoo/addons/base | |
| parent | 028ae76f3b53132ae5c1510a4285cc21fc120c76 (diff) | |
[IMP] base: properly handle API keys on inactive users
closes odoo/odoo#66439
Signed-off-by: Olivier Dony (odo) <odo@openerp.com>
Diffstat (limited to 'odoo/addons/base')
| -rw-r--r-- | odoo/addons/base/models/res_users.py | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/odoo/addons/base/models/res_users.py b/odoo/addons/base/models/res_users.py index b172f9d8311..af3e5a5756a 100644 --- a/odoo/addons/base/models/res_users.py +++ b/odoo/addons/base/models/res_users.py @@ -1658,7 +1658,11 @@ class APIKeys(models.Model): def _check_credentials(self, *, scope, key): assert scope, "scope is required" index = key[:INDEX_SIZE] - self.env.cr.execute('SELECT user_id, key FROM res_users_apikeys WHERE index = %s AND (scope IS NULL OR scope = %s)', [index, scope]) + self.env.cr.execute(''' + SELECT user_id, key + FROM res_users_apikeys INNER JOIN res_users u ON (u.id = user_id) + WHERE u.active and index = %s AND (scope IS NULL OR scope = %s) + ''', [index, scope]) for user_id, current_key in self.env.cr.fetchall(): if KEY_CRYPT_CONTEXT.verify(key, current_key): return user_id |