Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[15.0][FIX] password_security: Allow password hash updates #594

Closed
wants to merge 1 commit into from

Conversation

JonathanStein
Copy link

Updating the password hash fails, if "_set_encrypted_password" is called as a regular user.

The core _set_encrypted_password method executes a direct query without any access checks, so we assume it's safe to operate with sudo() here.

The problem was seen after odoo/odoo#146865 where hash strength is increased, resulting in password hash updates without a normal password change.

Copy link
Member

@fkantelberg fkantelberg left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Tested it and works. I do agree that the sudo is ok.

I have seen the PR too late but closed mine with the same fix. If you want to copy the unittest from #609 because it's an interesting case we have here.

Also related to #604

@JonathanStein
Copy link
Author

Closing this PR because #609 has the same fix but also includes test code

@JonathanStein JonathanStein deleted the patch-1 branch January 31, 2024 12:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants