From aac21e412531a5bf747de6bd2480b0157e03913f Mon Sep 17 00:00:00 2001 From: Xavier Morel Date: Fri, 25 May 2018 13:44:22 +0200 Subject: [CHG] Change login/auth internal protocol * Make Users._login and session.authenticate always raise AccessDenied on authentication failure instead of only sometimes (cf Session.authenticate calling security.check() which raises and not catching the exception) * Alter AccessDenied such that it's possible to add a custom access message, for use with login rate limiting instead of smuggling the information via the session * Alter the RPC endpoints to catch and convert AccessDenied back to a boolean sentinel --- odoo/exceptions.py | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) (limited to 'odoo/exceptions.py') diff --git a/odoo/exceptions.py b/odoo/exceptions.py index e1689ffd27f..c969d077a86 100644 --- a/odoo/exceptions.py +++ b/odoo/exceptions.py @@ -49,10 +49,12 @@ class RedirectWarning(Exception): class AccessDenied(Exception): - """ Login/password error. No message, no traceback. + """ Login/password error. no traceback. Example: When you try to log with a wrong password.""" - def __init__(self): - super(AccessDenied, self).__init__('Access denied') + def __init__(self, message='Access denied'): + super(AccessDenied, self).__init__(message) + self.with_traceback(None) + self.__cause__ = None self.traceback = ('', '', '') -- cgit v1.2.3