[CHG] Change login/auth internal protocol

* Make Users._login and session.authenticate always raise AccessDenied
  on authentication failure instead of only sometimes (cf
  Session.authenticate calling security.check() which raises and not
  catching the exception)
* Alter AccessDenied such that it's possible to add a custom access
  message, for use with login rate limiting instead of smuggling the
  information via the session
* Alter the RPC endpoints to catch and convert AccessDenied back to
  a boolean sentinel

1 files changed, 5 insertions, 3 deletions

diff --git a/odoo/exceptions.py b/odoo/exceptions.py
index e1689ffd27f..c969d077a86 100644
--- a/odoo/exceptions.py
+++ b/odoo/exceptions.py
@@ -49,10 +49,12 @@ class RedirectWarning(Exception):
 
 
 class AccessDenied(Exception):
-    """ Login/password error. No message, no traceback.
+    """ Login/password error. no traceback.
     Example: When you try to log with a wrong password."""
-    def __init__(self):
-        super(AccessDenied, self).__init__('Access denied')
+    def __init__(self, message='Access denied'):
+        super(AccessDenied, self).__init__(message)
+        self.with_traceback(None)
+        self.__cause__ = None
         self.traceback = ('', '', '')