[MERGE] forward port branch saas-16 up to 0b188b58046

1 files changed, 4 insertions, 12 deletions

diff --git a/odoo/http.py b/odoo/http.py
index eae6b69a76a..7524595406a 100644
--- a/odoo/http.py
+++ b/odoo/http.py
@@ -1030,6 +1030,7 @@ class OpenERPSession(werkzeug.contrib.sessions.Session):
         self.db = db
         self.uid = uid
         self.login = login
+        self.password = password
         request.uid = uid
         request.disable_db = False
 
@@ -1044,6 +1045,7 @@ class OpenERPSession(werkzeug.contrib.sessions.Session):
         """
         if not self.db or not self.uid:
             raise SessionExpiredException("Session expired")
+        security.check(self.db, self.uid, self.password)
 
     def logout(self, keep_db=False):
         for k in list(self):
@@ -1056,6 +1058,7 @@ class OpenERPSession(werkzeug.contrib.sessions.Session):
         self.setdefault("db", None)
         self.setdefault("uid", None)
         self.setdefault("login", None)
+        self.setdefault("password", None)
         self.setdefault("context", {})
 
     def get_context(self):
@@ -1268,17 +1271,6 @@ class DisableCacheMiddleware(object):
             start_response(status, new_headers)
         return self.app(environ, start_wrapped)
 
-class OdooSessionStore(werkzeug.contrib.sessions.FilesystemSessionStore):
-    def delete_sessions_for_uids(self, uids):
-        # pretty expensive on large session stores, especially non-local!
-        uids = set(uids)
-        _logger.info('Deleting all HTTP sessions for UIDs %s', uids)
-        for sid in self.list():
-            s = self.get(sid)
-            if s.uid and s.uid in uids:
-                _logger.debug('Deleting session %s', sid)
-                self.delete(s)
-
 class Root(object):
     """Root WSGI application for the OpenERP Web Client.
     """
@@ -1290,7 +1282,7 @@ class Root(object):
         # Setup http sessions
         path = odoo.tools.config.session_dir
         _logger.debug('HTTP sessions stored in: %s', path)
-        return OdooSessionStore(path, session_class=OpenERPSession)
+        return werkzeug.contrib.sessions.FilesystemSessionStore(path, session_class=OpenERPSession)
 
     @lazy_property
     def nodb_routing_map(self):