Merge lp:~fabien-morin/unifield-server/fm-us-1381-1802-1651-1763 into lp:unifield-server

[jftempo]

[lp:~fabien-morin/unifield-server/fm-us-1381-1802-1651-1763]

3996. By Fabien MORIN on 2016-11-16

US-1381 [IMP] comment the synchronize checkbox because the US-1381 is
postponned.

=== modified file 'bin/addons/base/base_update.xml'
--- bin/addons/base/base_update.xml	2016-06-15 09:19:59 +0000
+++ bin/addons/base/base_update.xml	2016-11-21 09:47:14 +0000
@@ -111,6 +111,12 @@
                     <field name="login" select="1"/>
                     <field name="new_password" password="True"/>
                     <field name="force_password_change"/>
+                    <!-- this functionnality is linked to US-1381. As this
+                         ticket was postponed to UF2.1-5, this checkbox will not be displayed until this ticket is not released
+                    <field name="synchronize" attrs="{'invisible': ['|', '|', ('is_erp_manager', '=', True), ('is_sync_config', '=', True), ('instance_level', '!=', 'section')]}"/>-->
+                    <field name="is_erp_manager" invisible="1"/>
+                    <field name="is_sync_config" invisible="1"/>
+                    <field name="instance_level" invisible="1"/>
                     <newline/>
                     <notebook colspan="4">
                         <page string="User">
@@ -164,6 +170,7 @@
                     <field name="login"/>
                     <field name="context_lang"/>
                     <field name="date"/>
+                    <field name="synchronize"/>
                 </tree>
             </field>
         </record>
@@ -178,6 +185,7 @@
                     <field name="login"/>
                     <field name="address_id" string="Address"/>
                     <field name="company_ids" string="Company" groups="base.group_multi_company"/>
+                    <field name="synchronize"/>
                 </search>
             </field>
         </record>

=== modified file 'bin/addons/base/res/res_user.py'
--- bin/addons/base/res/res_user.py	2016-10-04 15:38:43 +0000
+++ bin/addons/base/res/res_user.py	2016-11-21 09:47:14 +0000
@@ -30,7 +30,7 @@
 from service import security
 import netsvc
 import logging
-import re
+from passlib.hash import bcrypt
 
 class groups(osv.osv):
     _name = "res.groups"
@@ -103,7 +103,6 @@
     _name = "res.users"
     _order = 'name'
 
-    PASSWORD_MIN_LENGHT = 6
     WELCOME_MAIL_SUBJECT = u"Welcome to OpenERP"
     WELCOME_MAIL_BODY = u"An OpenERP account has been created for you, "\
         "\"%(name)s\".\n\nYour login is %(login)s, "\
@@ -135,7 +134,7 @@
 
     def send_welcome_email(self, cr, uid, id, context=None):
         logger= netsvc.Logger()
-        user = self.pool.get('res.users').read(cr, uid, id, context=context)
+        user = self.read(cr, uid, id, context=context)
         if not tools.config.get('smtp_server'):
             logger.notifyChannel('mails', netsvc.LOG_WARNING,
                 _('"smtp_server" needs to be set to send mails to users'))
@@ -214,11 +213,69 @@
             # so that the new password is immediately used for further RPC requests, otherwise the user
             # will face unexpected 'Access Denied' exceptions.
             raise osv.except_osv(_('Operation Canceled'), _('Please use the change password wizard (in User Preferences or User menu) to change your own password.'))
-        if not all(self.is_password_strong(value, login).values()):
-            raise osv.except_osv(_('Operation Canceled'), _('The new password is not strong enough. '\
-                    'Password must be different from the login, it must contain '\
-                    'at least one number and be at least %s characters.' % self.PASSWORD_MIN_LENGHT))
-        self.write(cr, uid, id, {'password': value})
+        security.check_password_validity(self, cr, uid, None, value, value, login)
+        encrypted_password = bcrypt.encrypt(tools.ustr(value))
+        self.write(cr, uid, id, {'password': encrypted_password})
+
+    def _is_erp_manager(self, cr, uid, ids, name=None, arg=None, context=None):
+        '''
+        return True if the user is member of the group_erp_manager (usually,
+        admin of the site).
+        '''
+        if isinstance(ids, (int, long)):
+            ids = [ids]
+        manager_group_id = None
+        result = dict.fromkeys(ids, False)
+        try:
+            dataobj = self.pool.get('ir.model.data')
+            dummy, manager_group_id = dataobj.get_object_reference(cr, 1, 'base',
+                    'group_erp_manager')
+        except ValueError:
+            # If these groups does not exists anymore
+            pass
+        if manager_group_id:
+            read_result = self.read(cr, uid, ids, ['groups_id'], context=context)
+            for current_user in read_result:
+                if manager_group_id in current_user['groups_id']:
+                    result[current_user['id']] = True
+        return result
+
+    def _is_sync_config(self, cr, uid, ids, name=None, arg=None, context=None):
+        '''
+        return True if the user is member of the Sync_Config
+        '''
+        if isinstance(ids, (int, long)):
+            ids = [ids]
+        result = dict.fromkeys(ids, False)
+        group_id = None
+        res_group_obj = self.pool.get('res.groups')
+        group_ids = res_group_obj.search(cr, uid,
+                [('name', '=', 'Sync_Config')], context=context)
+        if group_ids:
+            group_id = group_ids[0]
+            read_result = self.read(cr, uid, ids, ['groups_id'], context=context)
+            for current_user in read_result:
+                if group_id in current_user['groups_id']:
+                    result[current_user['id']] = True
+        return result
+
+    def _get_instance_level(self, cr, uid, ids, name=None, arg=None, context=None):
+        '''
+        return the level of the instance related to the company of the user
+        '''
+        if isinstance(ids, (int, long)):
+            ids = [ids]
+        result = {}
+        for user_id in ids:
+            level = False
+            company_id = self._get_company(cr, user_id, context=context)
+            instance_id = self.pool.get('res.company').read(cr, uid, company_id,
+                    ['instance_id'], context=context)['instance_id']
+            instance_id = instance_id and instance_id[0] or False
+            if instance_id:
+                level = self.pool.get('msf.instance').read(cr, uid, instance_id, ['level'], context=context)['level']
+            result[user_id] = level
+        return result
 
     _columns = {
         'name': fields.char('User Name', size=64, required=True, select=True,
@@ -226,7 +283,7 @@
                                  " and most listings"),
         'login': fields.char('Login', size=64, required=True,
                              help="Used to log into the system"),
-        'password': fields.char('Password', size=64, invisible=True, help="Keep empty if you don't want the user to be able to connect on the system."),
+        'password': fields.char('Password', size=128, invisible=True, help="Keep empty if you don't want the user to be able to connect on the system."),
         'new_password': fields.function(lambda *a:'', method=True, type='char', size=64,
                                 fnct_inv=_set_new_password,
                                 string='Change password', help="Only specify a value if you want to change the user password. "
@@ -265,6 +322,16 @@
         'user_email': fields.function(_email_get, method=True, fnct_inv=_email_set, string='Email', type="char", size=240),
         'menu_tips': fields.boolean('Menu Tips', help="Check out this box if you want to always display tips on each menu action"),
         'date': fields.datetime('Last Connection', readonly=True),
+        'synchronize': fields.boolean('Synchronize', help="Synchronize down this user"),
+        'is_erp_manager': fields.function(_is_erp_manager, method=True,
+            fnct_inv=lambda *a:'', string='Is ERP Manager ?',
+            type="boolean"),
+        'is_sync_config': fields.function(_is_sync_config, method=True,
+            fnct_inv=lambda *a:'', string='Is Sync Config ?',
+            type="boolean"),
+        'instance_level': fields.function(_get_instance_level, method=True,
+            fnct_inv=lambda *a:'', string='Instance level',
+            type="char"),
     }
 
     def on_change_company_id(self, cr, uid, ids, company_id):
@@ -277,17 +344,18 @@
 
     def read(self,cr, uid, ids, fields=None, context=None, load='_classic_read'):
         def override_password(o):
-            if 'password' in o and ( 'id' not in o or o['id'] != uid ):
+            if 'id' not in o or o['id'] != uid:
                 o['password'] = '********'
             return o
 
         result = super(users, self).read(cr, uid, ids, fields, context, load)
-        canwrite = self.pool.get('ir.model.access').check(cr, uid, 'res.users', 'write', raise_exception=False)
-        if not canwrite:
-            if isinstance(ids, (int, float)):
-                result = override_password(result)
-            else:
-                result = map(override_password, result)
+        if 'password' in result:
+            canwrite = self.pool.get('ir.model.access').check(cr, uid, 'res.users', 'write', raise_exception=False)
+            if not canwrite:
+                if isinstance(ids, (int, float)):
+                    result = override_password(result)
+                else:
+                    result = map(override_password, result)
         return result
 
 
@@ -321,7 +389,7 @@
     def _get_company(self,cr, uid, context=None, uid2=False):
         if not uid2:
             uid2 = uid
-        user = self.pool.get('res.users').read(cr, uid, uid2, ['company_id'], context)
+        user = self.read(cr, uid, uid2, ['company_id'], context)
         company_id = user.get('company_id', False)
         return company_id and company_id[0] or False
 
@@ -398,6 +466,13 @@
 
         res = super(users, self).write(cr, uid, ids, values, context=context)
 
+        # uncheck synchronize checkbox if the user is manager or sync config
+        if values.get('groups_id'):
+            if any(self._is_sync_config(cr, uid, ids, context=context).values()) or\
+               any(self._is_erp_manager(cr, uid, ids, context=context).values()):
+                vals = {'synchronize': False}
+                res = super(users, self).write(cr, uid, ids, vals, context=context)
+
         # clear caches linked to the users
         self.company_get.clear_cache(cr.dbname)
         self.pool.get('ir.model.access').call_cache_clearing_methods(cr)
@@ -461,51 +536,81 @@
         data_id = dataobj._get_id(cr, 1, 'base', 'action_res_users_my')
         return dataobj.browse(cr, uid, data_id, context=context).res_id
 
+    def get_user_database_password_from_uid(self, cr, uid):
+        '''
+        return encrypted password from the database using uid
+        '''
+        cr.execute("""SELECT password from res_users
+                      WHERE id=%s AND active""",
+                   (uid,))
+        res = cr.fetchone()
+        if res:
+            return tools.ustr(res[0])
+        return False
+
+    def get_user_database_password_from_login(self, cr, login):
+        '''
+        return encrypted password from the database using login
+        '''
+        login = tools.ustr(login).lower()
+        cr.execute("""SELECT password from res_users
+                      WHERE login=%s AND active""",
+                   (login,))
+        res = cr.fetchone()
+        if res:
+            return tools.ustr(res[0])
+        return False
+
     def login(self, db, login, password):
         if not password:
             return False
         login = tools.ustr(login).lower()
         cr = pooler.get_db(db).cursor()
         try:
-            # autocommit: our single request will be performed atomically.
-            # (In this way, there is no opportunity to have two transactions
-            # interleaving their cr.execute()..cr.commit() calls and have one
-            # of them rolled back due to a concurrent access.)
-            # We effectively unconditionally write the res_users line.
-            cr.autocommit(True)
-            # Even w/ autocommit there's a chance the user row will be locked,
-            # in which case we can't delay the login just for the purpose of
-            # update the last login date - hence we use FOR UPDATE NOWAIT to
-            # try to get the lock - fail-fast
-            cr.execute("""SELECT id from res_users
-                          WHERE login=%s AND password=%s
-                                AND active FOR UPDATE NOWAIT""",
-                       (login, tools.ustr(password)), log_exceptions=False)
-            cr.execute('UPDATE res_users SET date=now() WHERE login=%s AND password=%s AND active RETURNING id',
-                    (login, tools.ustr(password)))
-        except Exception:
-            # Failing to acquire the lock on the res_users row probably means
-            # another request is holding it - no big deal, we skip the update
-            # for this time, and let the user login anyway.
-            logging.getLogger('res.users').warn('Can\'t acquire lock on res users', exc_info=True)
-            cr.rollback()
-            cr.execute("""SELECT id from res_users
-                          WHERE login=%s AND password=%s
-                                AND active""",
-                       (login, tools.ustr(password)))
+            database_password = self.get_user_database_password_from_login(cr, login)
+            # check the password is a bcrypt encrypted one
+            database_password = tools.ustr(database_password)
+            password = tools.ustr(password)
+            if bcrypt.identify(database_password):
+                if not bcrypt.verify(password, database_password):
+                    return False
+            elif password != database_password:
+                return False
+            try:
+                # autocommit: our single request will be performed atomically.
+                # (In this way, there is no opportunity to have two transactions
+                # interleaving their cr.execute()..cr.commit() calls and have one
+                # of them rolled back due to a concurrent access.)
+                # We effectively unconditionally write the res_users line.
+                cr.autocommit(True)
+                # Even w/ autocommit there's a chance the user row will be locked,
+                # in which case we can't delay the login just for the purpose of
+                # update the last login date - hence we use FOR UPDATE NOWAIT to
+                # try to get the lock - fail-fast
+                cr.execute("""SELECT id from res_users
+                              WHERE login=%s AND password=%s
+                                    AND active FOR UPDATE NOWAIT""",
+                           (login, tools.ustr(database_password)), log_exceptions=False)
+                cr.execute('UPDATE res_users SET date=now() WHERE login=%s AND password=%s AND active RETURNING id',
+                        (login, tools.ustr(database_password)))
+            except Exception:
+                # Failing to acquire the lock on the res_users row probably means
+                # another request is holding it - no big deal, we skip the update
+                # for this time, and let the user login anyway.
+                logging.getLogger('res.users').warn('Can\'t acquire lock on res users', exc_info=True)
+                cr.rollback()
+                cr.execute("""SELECT id from res_users
+                              WHERE login=%s AND password=%s
+                                    AND active""",
+                           (login, tools.ustr(database_password)))
+            finally:
+                res = cr.fetchone()
+                if res:
+                    return res[0]
         finally:
-            res = cr.fetchone()
             cr.close()
-            if res:
-                return res[0]
         return False
 
-    def check_super(self, passwd):
-        if passwd == tools.config['admin_passwd']:
-            return True
-        else:
-            raise security.ExceptionNoTb('AccessDenied')
-
     def check(self, db, uid, passwd):
         """Verifies that the given (uid, password) pair is authorized for the database ``db`` and
            raise an exception if it is not."""
@@ -516,11 +621,16 @@
             return
         cr = pooler.get_db(db).cursor()
         try:
-            cr.execute('SELECT COUNT(1) FROM res_users WHERE id=%s AND password=%s AND active=%s',
-                        (int(uid), passwd, True))
-            res = cr.fetchone()[0]
-            if not res:
+            database_password = self.get_user_database_password_from_uid(cr, uid)
+            # check the password is a bcrypt encrypted one
+            database_password = tools.ustr(database_password)
+            passwd = tools.ustr(passwd)
+            if bcrypt.identify(database_password):
+                if not bcrypt.verify(passwd, database_password):
+                    raise security.ExceptionNoTb('AccessDenied')
+            elif passwd != database_password:
                 raise security.ExceptionNoTb('AccessDenied')
+
             if self._uid_cache.has_key(db):
                 ulist = self._uid_cache[db]
                 ulist[uid] = passwd
@@ -542,55 +652,51 @@
         finally:
             cr.close()
 
-    def is_password_strong(self, password, login):
-        """
-        Check that given password is strong enough.
-        In case it is, all values of the returned dict are True
-        """
-        result = {
-                'has_digit': False,
-                'long_enough': False,
-                'login_not_equal_password': False,
-        }
-
-        # check it contains at least one digit
-        if re.search(r'\d', password):
-            result['has_digit'] = True
-
-        # check password lenght
-        if len(password) >= self.PASSWORD_MIN_LENGHT:
-            result['long_enough'] = True
-
-        # check login != password:
-        if password != login:
-            result['login_not_equal_password'] = True
-
-        return result
-
-    def change_password(self, cr, uid, old_passwd, new_passwd, context=None):
+    def pref_change_password(self, cr, uid, old_passwd, new_passwd,
+            confirm_passwd, context=None):
+        self.check(cr.dbname, uid, tools.ustr(old_passwd))
+        login = self.read(cr, uid, uid, ['login'])['login']
+        return self.change_password(cr.dbname, login, old_passwd, new_passwd,
+                confirm_passwd, context=context)
+
+    def change_password(self, db_name, login, old_passwd, new_passwd,
+            confirm_passwd, context=None):
         """Change current user password. Old password must be provided explicitly
         to prevent hijacking an existing user session, or for cases where the cleartext
         password is not used to authenticate requests.
 
-        The write of the new password is done with uid=1 to prevent raise it
+        The write of the new password is done with uid=1 to prevent raise if
         the current logged user don't have permission on res_users.
 
         :return: True
         :raise: security.ExceptionNoTb when old password is wrong
         :raise: except_osv when new password is not set or empty
         """
-        self.check(cr.dbname, uid, old_passwd)
         if new_passwd:
-            login = self.read(cr, uid, uid, ['login'])['login']
-            if not all(self.is_password_strong(new_passwd, login).values()):
-                raise osv.except_osv(_('Operation Canceled'), _('The new password is not strong enough. '\
-                        'Password must be diffrent from the login, it must contain '\
-                        'at least one number and be at least %s characters.' % self.PASSWORD_MIN_LENGHT))
-            vals = {
-                'password': new_passwd,
-                'force_password_change': False,
-            }
-            return self.write(cr, 1, uid, vals)
+            cr = pooler.get_db(db_name).cursor()
+            try:
+                # get user_uid
+                cr.execute("""SELECT id from res_users
+                              WHERE login=%s AND active=%s""",
+                           (login, True))
+                res = cr.fetchone()
+                uid = None
+                if res:
+                    uid = res[0]
+                if not uid:
+                    raise security.ExceptionNoTb('AccessDenied')
+                security.check_password_validity(self, cr, uid, old_passwd, new_passwd, confirm_passwd, login)
+                new_passwd = bcrypt.encrypt(tools.ustr(new_passwd))
+                vals = {
+                    'password': new_passwd,
+                    'force_password_change': False,
+                }
+                self.check(db_name, uid, tools.ustr(old_passwd))
+                result = self.write(cr, 1, uid, vals)
+                cr.commit()
+            finally:
+                cr.close()
+            return result
         raise osv.except_osv(_('Warning!'), _("Setting empty passwords is not allowed for security reasons!"))
 
     def get_admin_profile(self, cr, uid, context=None):

=== modified file 'bin/addons/msf_profile/data/patches.xml'
--- bin/addons/msf_profile/data/patches.xml	2016-11-08 15:50:26 +0000
+++ bin/addons/msf_profile/data/patches.xml	2016-11-21 09:47:14 +0000
@@ -1,10 +1,17 @@
 <?xml version="1.0" encoding="utf-8" ?>
 <openerp>
     <data>
+<<<<<<< TREE
         <record id="us_1482" model="patch.scripts">
             <field name="method">us_1482_fix_default_code_on_msf_lines</field>
         </record>
 
+=======
+        <record id="us_1381" model="patch.scripts">
+            <field name="method">us_1381_encrypt_passwords</field>
+        </record>
+
+>>>>>>> MERGE-SOURCE
         <record id="us_1388" model="patch.scripts">
             <field name="method">us_1388_change_sequence_implementation</field>
         </record>

=== modified file 'bin/addons/msf_profile/i18n/fr_MF.po'
--- bin/addons/msf_profile/i18n/fr_MF.po	2016-11-09 15:21:10 +0000
+++ bin/addons/msf_profile/i18n/fr_MF.po	2016-11-21 09:47:14 +0000
@@ -74686,6 +74686,7 @@
 "	Number of columns is not equal to %s"
 msgstr "\n"
 "	Le nombre de colonnes n'est pas égal à %s"
+<<<<<<< TREE
 
 #. module: msf_partner
 #: constraint:res.partner:0
@@ -75092,3 +75093,83 @@
 msgid "Attachment configuration"
 msgstr "Configuration des pièces jointes"
 
+=======
+
+#. module: base
+#: code:addons/base/res/res_user.py:550
+#, python-format
+msgid "The new password is not strong enough. Password must contain at least one digit."
+msgstr "Le nouveau mot de passe n'est pas assez robuste. Il doit contenir au moins un chiffre."
+
+#. module: base
+#: code:addons/base/res/res_user.py:556
+#, python-format
+msgid "The new password is not strong enough. Password must be at least %s characters long."
+msgstr "Le nouveau mot de passe n'est pas assez robuste. Il doit être d'au moins %s caractères."
+
+#. module: base
+#: code:addons/base/res/res_user.py:561
+#, python-format
+msgid "The new password cannot be equal to the login."
+msgstr "Le nouveau mot de passe ne peut pas être égal à l'identifiant."
+
+#. module: base
+#: code:addons/base/res/res_user.py:566
+#, python-format
+msgid "The new password does not match the confirm password."
+msgstr "Le nouveau mot de passe ne correspond pas à la confirmation."
+
+#. module: base
+#: code:addons/base/res/res_user.py:571
+#, python-format
+msgid "The new password must be different from the actual one."
+msgstr "Le nouveau mot de passe doit être différent de l'actuel."
+
+#. module: base
+#: code:addons/base/res/res_user.py:537
+#, python-format
+msgid "Bad username or password"
+msgstr "Mauvais nom d'utilisateur ou mot de passe"
+
+#. module: base
+#: code:addons/base/res/res_user.py:623
+#, python-format
+msgid "Setting empty passwords is not allowed for security reasons!"
+msgstr "La définition de mot de passe vides n'est pas autorisée pour des raisons de sécurité !"
+
+#. module: base
+#: code:addons/base/res/res_user.py:229
+#, python-format
+msgid "Change password"
+msgstr "Changer le mot de passe"
+
+#. module: base
+#: code:addons/base/res/res_user.py:226
+#, python-format
+msgid "Password"
+msgstr "Mot de passe"
+
+#. module: base
+#: code:addons/base/res/res_user.py:224
+#, python-format
+msgid "Login"
+msgstr "Identifiant"
+
+#. module: base
+#: code:addons/base/res/res_user.py:238
+#, python-format
+msgid "Change password on next login"
+msgstr "Changer le mot de passe à la prochaine connexion"
+
+#. module: base
+#: code:addons/base/res/res_user.py:239
+#, python-format
+msgid "Check out this box to force this user to change his password on next login."
+msgstr "Cocher cette case pour forcer l'utilisateur à changer son mot de passe à la prochaine connexion."
+
+#. module: base
+#: code:addons/base/res/res_user.py:216
+#, python-format
+msgid "Please use the change password wizard (in User Preferences or User menu) to change your own password."
+msgstr "Merci d'utiliser l'assistant (dans les préférences de l'utilisateur ou le menu de l'utilisateur) pour changer votre propre mot de passe."
+>>>>>>> MERGE-SOURCE

=== modified file 'bin/addons/msf_profile/msf_profile.py'
--- bin/addons/msf_profile/msf_profile.py	2016-11-09 13:21:34 +0000
+++ bin/addons/msf_profile/msf_profile.py	2016-11-21 09:47:14 +0000
@@ -46,6 +46,7 @@
         'model': lambda *a: 'patch.scripts',
     }
 
+<<<<<<< TREE
     def us_1482_fix_default_code_on_msf_lines(self, cr, uid, *a, **b):
         """
         If the default code set on the MSR lines is different from the
@@ -69,6 +70,23 @@
         """
         cr.execute(request)
 
+=======
+    def us_1381_encrypt_passwords(self, cr, uid, *a, **b):
+        """
+        encrypt all passwords
+        """
+        from passlib.hash import bcrypt
+        users_obj = self.pool.get('res.users')
+        user_ids = users_obj.search(cr, uid, [])
+        for user in users_obj.read(cr, uid, user_ids, ['password']):
+            original_password = tools.ustr(user['password'])
+            # check the password is not already encrypted
+            if not bcrypt.identify(original_password):
+                encrypted_password = bcrypt.encrypt(original_password)
+                users_obj.write(cr, uid, user['id'],
+                        {'password': encrypted_password})
+
+>>>>>>> MERGE-SOURCE
     def us_1388_change_sequence_implementation(self, cr, uid, *a, **b):
         """
         change the implementation of the finance.ocb.export ir_sequence to be

=== modified file 'bin/addons/msf_profile/user_access_configurator_view.xml'
--- bin/addons/msf_profile/user_access_configurator_view.xml	2013-12-11 10:02:33 +0000
+++ bin/addons/msf_profile/user_access_configurator_view.xml	2016-11-21 09:47:14 +0000
@@ -395,6 +395,7 @@
             <field name="arch" type="xml">
                 <search string="Users">
                     <filter name="show_inactive" string="Show inactive" icon="gtk-ok" domain="[('active', '=', False)]" />
+                    <filter name="show_synchronized" string="Show synchronized" icon="gtk-ok" domain="[('synchronize', '=', True)]"/>
                     <field name="name" />
                     <field name="login" />
                     <field name="address_id" string="Address" />

=== modified file 'bin/addons/msf_sync_data_server/data/sync_server.sync_rule.csv'
--- bin/addons/msf_sync_data_server/data/sync_server.sync_rule.csv	2016-11-03 15:58:00 +0000
+++ bin/addons/msf_sync_data_server/data/sync_server.sync_rule.csv	2016-11-21 09:47:14 +0000
@@ -252,3 +252,4 @@
 msf_usb_sync_data_server.button_access_rules,FALSE,TRUE,FALSE,TRUE,cp_to_rw,Bidirectional,[],"['active', 'comment', 'group_ids/id', 'group_names', 'label', 'model_id/id', 'name', 'type', 'view_id/id']",USB,msf_button_access_rights.button_access_rule,,[USER RIGHTS] Button Access Rules,Valid,,4405
 msf_usb_sync_data_server.button_access_rules2,TRUE,TRUE,FALSE,TRUE,cp_to_rw,Bidirectional,[],"['active', 'comment', 'group_ids/id', 'group_names', 'label', 'model_id/id', 'name', 'type', 'view_id/id', 'xmlname']",USB,msf_button_access_rights.button_access_rule,,[USER RIGHTS] Button Access Rules,Valid,,4415
 msf_sync_data_server.ir_translation_USB,TRUE,TRUE,TRUE,TRUE,cp_to_rw,Down,"[('res_id', '!=', 0), ('src', '!=', False), ('xml_id', '!=', False), ('lang', '!=', 'en_US'), ('type', '=', 'model'), ('name', 'in', ['res.partner.category,name','product.uom,name','product.template,description_purchase','product.template,description','product.template,description_sale','product.uom.categ,name','product.pricelist,name','product.category,name','product.nomenclature,name','product.product,form_value','product.product,function_value','product.product,fit_value','res.currency,currency_name','res.country,name','product.ul,name','product.price.type,name','product.pricelist.type,name','product.pricelist.version,name','account.analytic.account,name','account.fiscal.position,note','hr.employee.marital.status,name','account.period,name','account.tax.code,name','account.journal,name','account.tax,name','account.analytic.journal,name','account.account,name','stock.reason.type,name','product.template,name','product.justification.code,code'])]","['lang', 'src', 'name', 'value', 'type', 'xml_id']",USB,ir.translation,,[OTHER] Translations,Valid,,4406
+msf_sync_data_server.res_users,TRUE,TRUE,TRUE,TRUE,bidirectional,Down,"[('synchronize', '=', True)]","['action_id/id', 'active', 'address_id/id', 'email', 'force_password_change', 'groups_id/id', 'login', 'menu_id/id', 'menu_tips', 'name', 'password', 'signature', 'user_email', 'view']",OC,res.users,,Res Users,Valid,,1002

=== modified file 'bin/addons/sync_client/rpc.py'
--- bin/addons/sync_client/rpc.py	2016-10-27 13:23:52 +0000
+++ bin/addons/sync_client/rpc.py	2016-11-21 09:47:14 +0000
@@ -373,7 +373,10 @@
         self.user_id = user_id
         if user_id is None:
             self.user_id = Common(self.connector).login(self.database, self.login, self.password)
+<<<<<<< TREE
 
+=======
+>>>>>>> MERGE-SOURCE
         if self.user_id is False:
             raise osv.except_osv(_('Error!'), _('Unable to connect to the distant server with this user!'))
         self._logger.debug(self.user_id)

=== modified file 'bin/openerp-server.py'
--- bin/openerp-server.py	2016-08-03 09:59:23 +0000
+++ bin/openerp-server.py	2016-11-21 09:47:14 +0000
@@ -125,15 +125,14 @@
     for dbname in tools.config['db_name'].split(','):
         db,pool = pooler.get_db_and_pool(dbname, update_module=tools.config['init'] or tools.config['update'], pooljobs=False)
         cr = db.cursor()
-
-        if tools.config["test_file"]:
-            logger.info('loading test file %s', tools.config["test_file"])
-            tools.convert_yaml_import(cr, 'base', file(tools.config["test_file"]), {}, 'test', True)
-            cr.rollback()
-
-        pool.get('ir.cron')._poolJobs(db.dbname)
-
-        cr.close()
+        try:
+            if tools.config["test_file"]:
+                logger.info('loading test file %s', tools.config["test_file"])
+                tools.convert_yaml_import(cr, 'base', file(tools.config["test_file"]), {}, 'test', True)
+                cr.rollback()
+            pool.get('ir.cron')._poolJobs(db.dbname)
+        finally:
+            cr.close()
 
 #----------------------------------------------------------
 # translation stuff
@@ -151,9 +150,11 @@
     buf = file(tools.config["translate_out"], "w")
     dbname = tools.config['db_name']
     cr = pooler.get_db(dbname).cursor()
-    tools.trans_export(tools.config["language"], tools.config["translate_modules"] or ["all"], buf, fileformat, cr)
-    cr.close()
-    buf.close()
+    try:
+        tools.trans_export(tools.config["language"], tools.config["translate_modules"] or ["all"], buf, fileformat, cr)
+    finally:
+        cr.close()
+        buf.close()
 
     logger.info('translation file written successfully')
     sys.exit(0)
@@ -162,13 +163,15 @@
     context = {'overwrite': tools.config["overwrite_existing_translations"]}
     dbname = tools.config['db_name']
     cr = pooler.get_db(dbname).cursor()
-    tools.trans_load(cr,
-                     tools.config["translate_in"], 
-                     tools.config["language"],
-                     context=context)
-    tools.trans_update_res_ids(cr)
-    cr.commit()
-    cr.close()
+    try:
+        tools.trans_load(cr,
+                         tools.config["translate_in"], 
+                         tools.config["language"],
+                         context=context)
+        tools.trans_update_res_ids(cr)
+    finally:
+        cr.commit()
+        cr.close()
     sys.exit(0)
 
 #----------------------------------------------------------------------------------

=== modified file 'bin/service/security.py'
--- bin/service/security.py	2016-07-19 13:25:46 +0000
+++ bin/service/security.py	2016-11-21 09:47:14 +0000
@@ -23,6 +23,11 @@
 import tools
 import threading
 import updater
+import re
+from passlib.hash import bcrypt
+from tools.translate import _
+from osv import osv
+PASSWORD_MIN_LENGHT = 6
 
 # When rejecting a password, hide the traceback
 class ExceptionNoTb(Exception):
@@ -32,8 +37,10 @@
 
 def number_update_modules(db):
     cr = pooler.get_db_only(db).cursor()
-    n = _get_number_modules(cr)
-    cr.close()
+    try:
+        n = _get_number_modules(cr)
+    finally:
+        cr.close()
     return n
 
 def _get_number_modules(cr, testlogin=False):
@@ -51,57 +58,145 @@
         return True
     return False
 
-def login(db, login, password):
-    cr = pooler.get_db_only(db).cursor()
-    nb = _get_number_modules(cr, testlogin=True)
-    patch_failed = [0]
-    cr.execute("SELECT relname FROM pg_class WHERE relkind IN ('r','v') AND relname='patch_scripts'")
-    if cr.rowcount:
-        cr.execute("SELECT count(id) FROM patch_scripts WHERE run = \'f\'")
-        patch_failed = cr.fetchone()
-    to_update = False
-    if not nb:
-        to_update = updater.test_do_upgrade(cr)
-    cr.close()
-    if nb or to_update:
-        s = threading.Thread(target=pooler.get_pool, args=(db,),
-                kwargs={'threaded': True})
-        s.start()
-        raise Exception("ServerUpdate: Server is updating modules ...")
-
-
-    pool = pooler.get_pool(db)
+def change_password(db_name, login, password, new_password, confirm_password):
+    '''
+    Call the res.user change_password method
+    '''
+    db, pool = pooler.get_db_and_pool(db_name)
+    cr = db.cursor()
+    try:
+        user_obj = pool.get('res.users')
+        result = user_obj.change_password(db_name, login, password, new_password,
+                confirm_password)
+    finally:
+        cr.close()
+    return result
+
+def login(db_name, login, password):
+    # it is required here not to get pool but only the db, if the pool it also
+    # get, then the server will update the module at this step without display
+    # the "Server is updating modules ..." message
+    cr = pooler.get_db_only(db_name).cursor()
+    try:
+        nb = _get_number_modules(cr, testlogin=True)
+        patch_failed = [0]
+        cr.execute("SELECT relname FROM pg_class WHERE relkind IN ('r','v') AND relname='patch_scripts'")
+        if cr.rowcount:
+            cr.execute("SELECT count(id) FROM patch_scripts WHERE run = \'f\'")
+            patch_failed = cr.fetchone()
+        to_update = False
+        if not nb:
+            to_update = updater.test_do_upgrade(cr)
+        if nb or to_update:
+            s = threading.Thread(target=pooler.get_pool, args=(db_name,),
+                    kwargs={'threaded': True})
+            s.start()
+            raise Exception("ServerUpdate: Server is updating modules ...")
+
+        pool = pooler.get_pool(db_name)
+        # check if the user have to change his password
+        cr.execute("""SELECT force_password_change
+        FROM res_users
+        WHERE login='%s'""" % (login))
+        force_password = [x[0] for x in cr.fetchall()]
+        if any(force_password):
+            raise Exception("ForcePasswordChange: The admin requests your password change ...")
+    finally:
+        cr.close()
+
     user_obj = pool.get('res.users')
-    user_res = user_obj.login(db, login, password)
+    user_res = user_obj.login(db_name, login, password)
 
     if user_res != 1 and patch_failed[0]:
         raise Exception("PatchFailed: A script during upgrade has failed. Login is forbidden. Please contact your administrator")
 
     return user_res
 
+def check_password_validity(self, cr, uid, old_password, new_password, confirm_password, login):
+    '''
+    Check password respect some conditions
+    Raise is any of the condition is not respected
+
+    :param self: the caller of this method. It is needed for _get_lang to be
+    able to know the language of the requested user
+    :param cr: database cursor
+    :param uid: the user id of the password to check
+    :param old_password: the previous password
+    :param new_password: the new password to setup
+    :param confirm_password: the confirmation of the new password
+    :param login: the login that request the password check
+    :return: True if the password check pass
+    :rtype: boolean
+    :raise osv.except_osv: if the password is not ok
+    '''
+    # check it contains at least one digit
+    if not re.search(r'\d', new_password):
+        message = _('The new password is not strong enough. '\
+            'Password must contain at least one digit.')
+        raise osv.except_osv(_('Operation Canceled'), message)
+
+    # check new_password lenght
+    if len(new_password) < PASSWORD_MIN_LENGHT:
+        message = _('The new password is not strong enough. '\
+            'Password must be at least %s characters long.' % PASSWORD_MIN_LENGHT)
+        raise osv.except_osv(_('Operation Canceled'), message)
+
+    # check login != new_password:
+    if new_password == login:
+        message = _('The new password cannot be equal to the login.')
+        raise osv.except_osv(_('Operation Canceled'), message)
+
+    # check confirm_password == new_password:
+    if new_password != confirm_password:
+        message = _('The new password does not match the confirm password.')
+        raise osv.except_osv(_('Operation Canceled'), message)
+
+    # check new_password != old_password
+    if new_password == old_password:
+        message = _('The new password must be different from the actual one.')
+        raise osv.except_osv(_('Operation Canceled'), message)
+    return True
+
+def check_password(password, hashed_password):
+    '''
+    Check that the password match the hashed_password
+
+    :param password: a string containing the password to check
+    :param hashed_password: a string containing the hash to check against, such
+    as returned by encrypt()
+    :return: True if the password match
+    :rtype: boolean
+    :raise ExceptionNoTb: if password don't match
+    '''
+    hashed_password = tools.ustr(hashed_password)
+    password = tools.ustr(password)
+
+    # check the password is a bcrypt encrypted one
+    if bcrypt.identify(hashed_password) and \
+            bcrypt.verify(password, hashed_password):
+        return True
+    elif password == hashed_password:
+        # this is a not encrypted password (we want to keep compatibility with
+        # old way password
+        return True
+    else:
+        raise ExceptionNoTb('AccessDenied: Invalid super administrator password.')
+
+def check_super_password_validity(password):
+    check_password_validity(None, None, 1, None, password, password, 'admin')
+    return True
+
 def check_super(passwd):
-    if passwd == tools.config['admin_passwd']:
-        return True
-    else:
-        raise ExceptionNoTb('AccessDenied: Invalid super administrator password.')
+    return check_password(passwd, tools.config['admin_passwd'])
 
 def check_super_dropdb(passwd):
-    if passwd == tools.config['admin_dropdb_passwd']:
-        return True
-    else:
-        raise ExceptionNoTb('AccessDenied: Invalid super administrator password.')
+    return check_password(passwd, tools.config['admin_dropdb_passwd'])
 
 def check_super_bkpdb(passwd):
-    if passwd == tools.config['admin_bkpdb_passwd']:
-        return True
-    else:
-        raise ExceptionNoTb('AccessDenied: Invalid super administrator password.')
+    return check_password(passwd, tools.config['admin_bkpdb_passwd'])
 
 def check_super_restoredb(passwd):
-    if passwd == tools.config['admin_restoredb_passwd']:
-        return True
-    else:
-        raise ExceptionNoTb('AccessDenied: Invalid super administrator password.')
+    return check_password(passwd, tools.config['admin_restoredb_passwd'])
 
 def check(db, uid, passwd):
     pool = pooler.get_pool(db)

=== modified file 'bin/service/web_services.py'
--- bin/service/web_services.py	2016-11-09 09:47:06 +0000
+++ bin/service/web_services.py	2016-11-21 09:47:14 +0000
@@ -44,11 +44,15 @@
 from cStringIO import StringIO
 from tempfile import NamedTemporaryFile
 from updater import get_server_version
+<<<<<<< TREE
 from tools.misc import file_open
 from mako.template import Template
 from mako import exceptions
 from mako.runtime import Context
 import codecs
+=======
+from passlib.hash import bcrypt
+>>>>>>> MERGE-SOURCE
 
 def export_csv(fields, result, result_file_path):
     try:
@@ -111,7 +115,12 @@
             params = params[1:]
             security.check_super(passwd)
         elif method in [ 'db_exist', 'list', 'list_lang', 'server_version',
+<<<<<<< TREE
                          'check_timezone', 'connected_to_prod_sync_server' ]:
+=======
+                'check_timezone', 'connected_to_prod_sync_server',
+                'check_super_password_validity' ]:
+>>>>>>> MERGE-SOURCE
             # params = params
             # No security check for these methods
             pass
@@ -137,11 +146,12 @@
         self.id += 1
         id = self.id
         self.id_protect.release()
-
         self.actions[id] = {'clean': False}
-
         self._create_empty_database(db_name)
 
+        # encrypt the db admin password
+        user_password = bcrypt.encrypt(tools.ustr(user_password))
+
         class DBInitialize(object):
             def __call__(self, serv, id, db_name, demo, lang, user_password='admin'):
                 cr = None
@@ -171,7 +181,6 @@
                     serv.actions[id]['users'] = cr.dictfetchall()
                     serv.actions[id]['clean'] = True
                     cr.commit()
-                    cr.close(True)
                 except Exception, e:
                     serv.actions[id]['clean'] = False
                     serv.actions[id]['exception'] = e
@@ -182,6 +191,7 @@
                     e_str.close()
                     netsvc.Logger().notifyChannel('web-services', netsvc.LOG_ERROR, 'CREATE DATABASE\n%s' % (traceback_str))
                     serv.actions[id]['traceback'] = traceback_str
+                finally:
                     if cr:
                         cr.close(True)
         logger = netsvc.Logger()
@@ -193,6 +203,13 @@
         self.actions[id]['thread'] = create_thread
         return id
 
+    def exp_check_super_password_validity(self, password):
+        try:
+            security.check_super_password_validity(password)
+        except Exception as e:
+            return str(e)
+        return True
+
     def exp_check_timezone(self):
         return check_tz()
 
@@ -380,10 +397,12 @@
             return False
 
         cr = connection.cursor()
-        cr.execute('''SELECT host, database
-        FROM sync_client_sync_server_connection''')
-        host, database = cr.fetchone()
-        cr.close()
+        try:
+            cr.execute('''SELECT host, database
+            FROM sync_client_sync_server_connection''')
+            host, database = cr.fetchone()
+        finally:
+            cr.close()
         if host and database and database.strip() == 'SYNC_SERVER' and \
                 ('sync.unifield.net' in host.lower() or '212.95.73.129' in host):
             return True
@@ -409,16 +428,18 @@
         db = sql_db.db_connect(dbname)
         cr = db.cursor()
 
-        # check sync_client_version table existance
-        cr.execute("SELECT relname FROM pg_class WHERE relkind IN ('r','v') AND relname='sync_client_version'")
-        if not cr.fetchone():
-            # the table sync_client_version doesn't exists, fallback on the
-            # version from release.py file
-            return release.version or 'UNKNOWN_VERSION'
+        try:
+            # check sync_client_version table existance
+            cr.execute("SELECT relname FROM pg_class WHERE relkind IN ('r','v') AND relname='sync_client_version'")
+            if not cr.fetchone():
+                # the table sync_client_version doesn't exists, fallback on the
+                # version from release.py file
+                return release.version or 'UNKNOWN_VERSION'
 
-        cr.execute("SELECT name, sum FROM sync_client_version WHERE state='installed' ORDER BY applied DESC")
-        res = cr.fetchone()
-        cr.close(True)
+            cr.execute("SELECT name, sum FROM sync_client_version WHERE state='installed' ORDER BY applied DESC")
+            res = cr.fetchone()
+        finally:
+            cr.close(True)
         if res and res[0]:
             return res[0]
         elif res[1]:
@@ -459,10 +480,12 @@
         params = params[3:]
         security.check(db,uid,passwd)
         cr = pooler.get_db(db).cursor()
-        fn = getattr(self, 'exp_'+method)
-        res = fn(cr, uid, *params)
-        cr.commit()
-        cr.close()
+        try:
+            fn = getattr(self, 'exp_'+method)
+            res = fn(cr, uid, *params)
+            cr.commit()
+        finally:
+            cr.close()
         return res
 
 class common(_ObjectService):
@@ -484,6 +507,17 @@
             return res or False
         elif method == 'number_update_modules':
             return security.number_update_modules(params[0])
+        elif method == 'change_password':
+            try:
+                security.change_password(params[0], params[1], params[2],
+                        params[3], params[4])
+            except Exception as e:
+                if hasattr(e, 'value'):
+                    msg = tools.ustr(e.value)
+                else:
+                    msg = tools.ustr(e)
+                return msg
+            return True
         elif method == 'logout':
             if auth:
                 auth.logout(params[1])
@@ -1009,8 +1043,9 @@
                 else:
                     self._reports[id]['exception'] = ExceptionWithTraceback(tools.exception_to_unicode(exception), tb)
                 self._reports[id]['state'] = True
-            cr.commit()
-            cr.close()
+            finally:
+                cr.commit()
+                cr.close()
             return True
 
         thread.start_new_thread(go, (id, uid, ids, datas, context))

=== modified file 'setup.py'
--- setup.py	2016-11-09 13:21:34 +0000
+++ setup.py	2016-11-21 09:47:14 +0000
@@ -65,7 +65,11 @@
                 "HTMLParser", "select", "mako", "poplib",
                 "imaplib", "smtplib", "email", "yaml", "DAV",
                 "uuid", "commands", "mx.DateTime", "json",
+<<<<<<< TREE
                 "pylzma", "xlwt"
+=======
+                "pylzma", "passlib", "bcrypt", "six", "cffi",
+>>>>>>> MERGE-SOURCE
             ],
             "excludes" : ["Tkconstants","Tkinter","tcl"],
         }