From f551350b8093816ed7ec456d786bb231ffec0460 Mon Sep 17 00:00:00 2001 From: Denis Ledoux Date: Thu, 1 Aug 2013 17:15:39 +0200 Subject: [FIX]auth_crypt: check_credentials checking if there is a password stored, if not, not trying to crypt anything and raise bzr revid: dle@openerp.com-20130801151539-z0bes7ylx5qwa8tw --- addons/auth_crypt/auth_crypt.py | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) (limited to 'addons/auth_crypt/auth_crypt.py') diff --git a/addons/auth_crypt/auth_crypt.py b/addons/auth_crypt/auth_crypt.py index d0a4fda9632..08dd156a603 100644 --- a/addons/auth_crypt/auth_crypt.py +++ b/addons/auth_crypt/auth_crypt.py @@ -143,7 +143,7 @@ class res_users(osv.osv): cr.execute('SELECT password, password_crypt FROM res_users WHERE id=%s AND active', (uid,)) if cr.rowcount: stored_password, stored_password_crypt = cr.fetchone() - if password and not stored_password_crypt: + if stored_password and not stored_password_crypt: salt = gen_salt() stored_password_crypt = md5crypt(stored_password, salt) cr.execute("UPDATE res_users SET password='', password_crypt=%s WHERE id=%s", (stored_password_crypt, uid)) @@ -151,14 +151,15 @@ class res_users(osv.osv): return super(res_users, self).check_credentials(cr, uid, password) except openerp.exceptions.AccessDenied: # check md5crypt - if stored_password_crypt[:len(magic_md5)] == magic_md5: - salt = stored_password_crypt[len(magic_md5):11] - if stored_password_crypt == md5crypt(password, salt): - return - elif stored_password_crypt[:len(magic_md5)] == magic_sha256: - salt = stored_password_crypt[len(magic_md5):11] - if stored_password_crypt == md5crypt(password, salt): - return + if stored_password_crypt: + if stored_password_crypt[:len(magic_md5)] == magic_md5: + salt = stored_password_crypt[len(magic_md5):11] + if stored_password_crypt == md5crypt(password, salt): + return + elif stored_password_crypt[:len(magic_md5)] == magic_sha256: + salt = stored_password_crypt[len(magic_md5):11] + if stored_password_crypt == md5crypt(password, salt): + return # Reraise password incorrect raise -- cgit v1.2.3 From b6cd0ea82047573509c84b18b1ef5cade89a729b Mon Sep 17 00:00:00 2001 From: Denis Ledoux Date: Thu, 1 Aug 2013 18:27:04 +0200 Subject: [FIX]auth_crypt: was storing password when passsing by res.users create, like auth_signup bzr revid: dle@openerp.com-20130801162704-fbvghil7yir8zm8c --- addons/auth_crypt/auth_crypt.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'addons/auth_crypt/auth_crypt.py') diff --git a/addons/auth_crypt/auth_crypt.py b/addons/auth_crypt/auth_crypt.py index 08dd156a603..4651d27fe7d 100644 --- a/addons/auth_crypt/auth_crypt.py +++ b/addons/auth_crypt/auth_crypt.py @@ -120,7 +120,7 @@ class res_users(osv.osv): def set_pw(self, cr, uid, id, name, value, args, context): if value: encrypted = md5crypt(value, gen_salt()) - cr.execute('update res_users set password_crypt=%s where id=%s', (encrypted, int(id))) + cr.execute("update res_users set password='', password_crypt=%s where id=%s", (encrypted, id)) del value def get_pw( self, cr, uid, ids, name, args, context ): -- cgit v1.2.3