From 7d16769263b9cdefadb5059c04c0fc8892353c54 Mon Sep 17 00:00:00 2001 From: Olivier Dony Date: Tue, 3 Oct 2017 12:34:50 +0200 Subject: [IMP] config: support hashed master passwords - Add support for hashed master passwords (super-admin password) using a strong scheme (PBKDF2_SHA512). - Replace the password with a hash in memory (tools.config map), after verifying it - Automatically replace the plaintext master password with a hash when saving it after a password change - Preserve support for setting/using plaintext passwords when necessary (e.g. as a temporary deployment thing) --- addons/web/controllers/main.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'addons/web/controllers/main.py') diff --git a/addons/web/controllers/main.py b/addons/web/controllers/main.py index 2e3ad2357fe..cc2ef4201df 100644 --- a/addons/web/controllers/main.py +++ b/addons/web/controllers/main.py @@ -647,7 +647,7 @@ class Database(http.Controller): def _render_template(self, **d): d.setdefault('manage',True) - d['insecure'] = odoo.tools.config['admin_passwd'] == 'admin' + d['insecure'] = odoo.tools.config.verify_admin_password('admin') d['list_db'] = odoo.tools.config['list_db'] d['langs'] = odoo.service.db.exp_list_lang() d['countries'] = odoo.service.db.exp_list_countries() -- cgit v1.2.3 From b02dea768814f878bffe9ff1f42304a45d3189de Mon Sep 17 00:00:00 2001 From: Olivier Dony Date: Tue, 3 Oct 2017 12:34:50 +0200 Subject: [IMP] config: allow blocking access to db manager - The `--no-database-list` option will now also block access to database management functions and screens. Presumably this flag should only be used in production when all databases have been provisioned, so the admin should like to block access to the db manager at the same time. - If no `--database` or `-d` parameter is provided, the system will be unable to fetch a list of databases at all, so users will be blocked with an error message. - Hide the link on the login screen to the DB manager when it is disabled, to prevent sending users to an error page. - Weak attempt at updating the documentation Note: the security check for RPC methods could have been done in the RPC dispatcher, however that would not have protected service methods when called directly, e.g. by a controller (e.g. the dump method). --- addons/web/controllers/main.py | 3 +++ 1 file changed, 3 insertions(+) (limited to 'addons/web/controllers/main.py') diff --git a/addons/web/controllers/main.py b/addons/web/controllers/main.py index cc2ef4201df..17ca031a48f 100644 --- a/addons/web/controllers/main.py +++ b/addons/web/controllers/main.py @@ -491,6 +491,9 @@ class Home(http.Controller): if 'login' not in values and request.session.get('auth_login'): values['login'] = request.session.get('auth_login') + if not odoo.tools.config['list_db']: + values['disable_database_manager'] = True + response = request.render('web.login', values) response.headers['X-Frame-Options'] = 'DENY' return response -- cgit v1.2.3