[15.0][FIX] password_security: Fix access error on login #609
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…be updated after the round change from 25000 to 600000 in core odoo
|
Closed because I haven't seen #594 |
Great, that you made a test case. I think it's easier if you reopen this PR, and I just close mine. |
|
There hasn't been any activity on this pull request in the past 4 months, so it has been marked as stale and it will be closed automatically if no further activity occurs in the next 30 days. |
github-actions
bot
added
the
stale
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Because of [1] Odoo runs into an access error when a password hash will be updated. Previous to the patch the rounds were 25000 and if you login after the patch the same password will be validated and the new one will be updated which will cause Odoo to crash because the user and portal user can't write to the field
password_history_ids.I decided to use sudo because the access handling was already done in super.
Another option would have been to create the
res.users.pass.historydirectly without writing tores.usersbut portal user don't have the access to that model (only internal users) and I would have to add the security rule.I added an unittest which is reproducing the error.
[1] OCA/OCB@5502bec