[MERGE] forward port branch saas-14 up to 8b8f04e14c9

3 files changed, 6 insertions, 20 deletions

diff --git a/odoo/addons/base/ir/ir_actions.py b/odoo/addons/base/ir/ir_actions.py
index 26cab3653b1..bb5fd6eaac6 100644
--- a/odoo/addons/base/ir/ir_actions.py
+++ b/odoo/addons/base/ir/ir_actions.py
@@ -374,7 +374,7 @@ class IrActionsActWindowView(models.Model):
     _name = 'ir.actions.act_window.view'
     _table = 'ir_act_window_view'
     _rec_name = 'view_id'
-    _order = 'sequence'
+    _order = 'sequence,id'
 
     sequence = fields.Integer()
     view_id = fields.Many2one('ir.ui.view', string='View')
diff --git a/odoo/addons/base/res/res_users.py b/odoo/addons/base/res/res_users.py
index 657bebf58a7..596620a9e52 100644
--- a/odoo/addons/base/res/res_users.py
+++ b/odoo/addons/base/res/res_users.py
@@ -14,7 +14,6 @@ from odoo.exceptions import AccessDenied, AccessError, UserError, ValidationErro
 from odoo.osv import expression
 from odoo.service.db import check_super
 from odoo.tools import partition
-from odoo.http import root
 
 _logger = logging.getLogger(__name__)
 
@@ -373,8 +372,6 @@ class Users(models.Model):
         if any(key.startswith('context_') or key in ('lang', 'tz') for key in values):
             self.context_get.clear_cache(self)
         if any(key in values for key in ['active'] + USER_PRIVATE_FIELDS):
-            # force deletion of all sessions for these users
-            root.session_store.delete_sessions_for_uids(self.ids)
             db = self._cr.dbname
             for id in self.ids:
                 self.__uid_cache[db].pop(id, None)
@@ -388,10 +385,7 @@ class Users(models.Model):
         db = self._cr.dbname
         for id in self.ids:
             self.__uid_cache[db].pop(id, None)
-        res = super(Users, self).unlink()
-        # force deletion of all sessions for these users
-        root.session_store.delete_sessions_for_uids(self.ids)
-        return res
+        return super(Users, self).unlink()
 
     @api.model
     def name_search(self, name='', args=None, operator='ilike', limit=100):
diff --git a/odoo/http.py b/odoo/http.py
index 46d744f2f36..56b1f8e6930 100644
--- a/odoo/http.py
+++ b/odoo/http.py
@@ -1040,6 +1040,7 @@ class OpenERPSession(werkzeug.contrib.sessions.Session):
         self.db = db
         self.uid = uid
         self.login = login
+        self.password = password
         request.uid = uid
         request.disable_db = False
 
@@ -1054,6 +1055,7 @@ class OpenERPSession(werkzeug.contrib.sessions.Session):
         """
         if not self.db or not self.uid:
             raise SessionExpiredException("Session expired")
+        security.check(self.db, self.uid, self.password)
 
     def logout(self, keep_db=False):
         for k in self.keys():
@@ -1066,6 +1068,7 @@ class OpenERPSession(werkzeug.contrib.sessions.Session):
         self.setdefault("db", None)
         self.setdefault("uid", None)
         self.setdefault("login", None)
+        self.setdefault("password", None)
         self.setdefault("context", {})
 
     def get_context(self):
@@ -1278,17 +1281,6 @@ class DisableCacheMiddleware(object):
             start_response(status, new_headers)
         return self.app(environ, start_wrapped)
 
-class OdooSessionStore(werkzeug.contrib.sessions.FilesystemSessionStore):
-    def delete_sessions_for_uids(self, uids):
-        # pretty expensive on large session stores, especially non-local!
-        uids = set(uids)
-        _logger.info('Deleting all HTTP sessions for UIDs %s', uids)
-        for sid in self.list():
-            s = self.get(sid)
-            if s.uid and s.uid in uids:
-                _logger.debug('Deleting session %s', sid)
-                self.delete(s)
-
 class Root(object):
     """Root WSGI application for the OpenERP Web Client.
     """
@@ -1300,7 +1292,7 @@ class Root(object):
         # Setup http sessions
         path = odoo.tools.config.session_dir
         _logger.debug('HTTP sessions stored in: %s', path)
-        return OdooSessionStore(path, session_class=OpenERPSession)
+        return werkzeug.contrib.sessions.FilesystemSessionStore(path, session_class=OpenERPSession)
 
     @lazy_property
     def nodb_routing_map(self):