[MERGE] forward port branch 11.0 up to eefe879a37a

1 files changed, 12 insertions, 4 deletions

diff --git a/odoo/http.py b/odoo/http.py
index 33b4b58aac8..63d7ece05d5 100644
--- a/odoo/http.py
+++ b/odoo/http.py
@@ -1029,7 +1029,6 @@ class OpenERPSession(werkzeug.contrib.sessions.Session):
         self.db = db
         self.uid = uid
         self.login = login
-        self.password = password
         request.uid = uid
         request.disable_db = False
 
@@ -1044,7 +1043,6 @@ class OpenERPSession(werkzeug.contrib.sessions.Session):
         """
         if not self.db or not self.uid:
             raise SessionExpiredException("Session expired")
-        security.check(self.db, self.uid, self.password)
 
     def logout(self, keep_db=False):
         for k in list(self):
@@ -1057,7 +1055,6 @@ class OpenERPSession(werkzeug.contrib.sessions.Session):
         self.setdefault("db", None)
         self.setdefault("uid", None)
         self.setdefault("login", None)
-        self.setdefault("password", None)
         self.setdefault("context", {})
 
     def get_context(self):
@@ -1271,6 +1268,17 @@ class DisableCacheMiddleware(object):
             start_response(status, new_headers)
         return self.app(environ, start_wrapped)
 
+class OdooSessionStore(werkzeug.contrib.sessions.FilesystemSessionStore):
+    def delete_sessions_for_uids(self, uids):
+        # pretty expensive on large session stores, especially non-local!
+        uids = set(uids)
+        _logger.info('Deleting all HTTP sessions for UIDs %s', uids)
+        for sid in self.list():
+            s = self.get(sid)
+            if s.uid and s.uid in uids:
+                _logger.debug('Deleting session %s', sid)
+                self.delete(s)
+
 class Root(object):
     """Root WSGI application for the OpenERP Web Client.
     """
@@ -1282,7 +1290,7 @@ class Root(object):
         # Setup http sessions
         path = odoo.tools.config.session_dir
         _logger.debug('HTTP sessions stored in: %s', path)
-        return werkzeug.contrib.sessions.FilesystemSessionStore(path, session_class=OpenERPSession)
+        return OdooSessionStore(path, session_class=OpenERPSession)
 
     @lazy_property
     def nodb_routing_map(self):