Merge lp:~sylvain-legal/server-env-tools/7.0-auth_admin_passkey into lp:~server-env-tools-core-editors/server-env-tools/7.0

[Sylvain LE GAL (GRAP)]

[ADD] new module 'auth_admin_passkey' that allow admin user (uid=1) to login with any login and his password.

[ADD] new module 'auth_admin_passkey' that allow admin user (uid=1) to login with any login and his password.

[Stefan Rijnhart (Opener) (stefan-opener)]

Great idea! The code looks good too. Thanks! Compatibility with auth_crypt is important, but if you say it can be done in a glue module we can leave it for someone to make this effort later on.

review: Approve

[Davide Corio (enlightx-deactivatedaccount)]

Thank you very much Sylvain!
And it works on trunk too.

review: Approve

[Benoit Guillot - http://www.akretion.com (benoit-guillot-z)]

Very useful !

review: Approve

[Sylvain LE GAL (GRAP) (sylvain-legal)]

Thanks for your reviews and for your interests.

@Stefan :
Sorry if was not clear : I'm not sure that is possible to do that with a glue module, and how. I just guess !
What I want :
- define in a predictive way the order of the call of the 2 functions : auth_crypt.res_users.check_credentials() and auth_admin_passkey.res_users.check_credentials()

What I know :
1/ I tested my module with 'auth_crypt' and it works depending of installation order (what I wrote in my description) ;
2/ I developed a glue module testing differents thinks like changing order of module in the __openerp__.py 'depends' value, but it didn't seem to work ;

Reference :
[Sep 2009] http://forum.openerp.com/forum/topic12962.html talk about alphabetic order but it contradicts my observation #1 ;
[2013] http://help.openerp.com/question/36392/how-openerp-decides-loading-order-of-modules/ talk about the order in 'depends' value but it contradicts my observation #2 ;

Dependencies tree (for your information) :
base : []
web : []
auth_crypt : ['base']
web_kanban : ['web']
base_setup : ['base', 'web_kanban']
mail : ['base', 'base_setup']
auth_admin_passkey : ['mail']

If somebody knows more about module order and how to manage that case ...

Regards.

[Daniel Reis (dreis-pt)]

Great work!

Nitpicks:

L103: could you add the .pot file?
L254-256: the body header text would be best as a single translatable string
L262: s/"Passkey used"/_("Passkey used")

[Stefan Rijnhart (Opener) (stefan-opener)]

Some more comments from my side:

Wild idea: in your override of check_credentials, why don't you first check if uid != SUPERUSER_ID and in that case don't call *super* but call self.check_credentials itself with the SUPERUSER_ID argument? This should fix compatibility with any authentication module.

Note that there is a small security risk in sending the emails to the unprivileged user: if such a user happens to have the same password as the administrator (it might just happen), they will receive an email that the adminitrator has logged on as themselves. They may then figure out that their password is the same as the administrator's, and they might then take advantage of that.

l.275: would it maybe make more sense if you check this condition *before* the try block in l.271?

review: Needs Information

[Sylvain LE GAL (GRAP) (sylvain-legal)]

Hi,

@Stefan,
Remarks 1 : I didn't understand what your 'wild' idea can fix. (about possible compatibility problem).

Remarks 2 : Héhé. Yes I thought of that very specific case without solution. I finally found a workaround to manage this case and I'll update the Merge Proposal in a while. (Work in progress again).

Remarks 3 : You're right. MP updated.

@Daniel :
Point 1 : Excuse my basic question but what is the interest to add '.pot' file. (I don't use it in my personal module).
Extra Question : How to generate it ? OpenERP only propose "po" / "csv" and "tgz". ".pot" file seems to be a ".po" file with empty traduction. It isn't ?

Point 2 : My code doesn't manage translation for the mails. (it is written in __openerp__.py), not because I did'nt call "_" function but because I haven't contextual information at this step. So the function "_" will not work. The workaround is to get language of each user. (normal & admin) requesting the database, update twice some context value, call "_" function ... I confess that I am not very motivated to write this code. But it can be the aim of a futur Merge Proposal.

Regards.

[Davide Corio (enlightx-deactivatedaccount)]

Daniel is right, pot file is missing (required as per community guide lines).
you just need to export the .po w/o selecting a specific language, then rename the file as your_module_name.pot and place it into the i18n folder.

review: Needs Fixing

[Stefan Rijnhart (Opener) (stefan-opener)]

Well the problem with auth_crypt is that the inheritance structure can be as follows:

-> auth_crypt -> auth_passkey -> base.

Authentication of regular user account with admin password fails in auth_crypt. Auth_crypt calls super(), which is this module's override. Regular authentication of the user account with the admin password fails. You then call super() with the SUPERUSER_ID which fails because the password is encrypted. If you call self.check_credentials from your self_credentials override, then you pass through auth_crypt again which now succesfully authenticates the administrator account. Or not, but then you don't call self.check_credentials but super instead because uid is already SUPERUSER_ID.

[lp:~sylvain-legal/server-env-tools/7.0-auth_admin_passkey]

67. By Sylvain LE GAL (GRAP) on 2014-03-23

[IMP] 'auth_admin_passkey' works now indepently from the order of the installation of modules 'auth_admin_passkey' and 'auth_crypt'. (Courtesy of Stefan Rijnhart).

68. By Sylvain LE GAL (GRAP) on 2014-03-23

[IMP] Emails are now translated.

[Sylvain LE GAL (GRAP) (sylvain-legal)]

@Stefan (rev65) : (about remark #2) I updated the algorithm to manage the special case where admin and user has the same password. In that case, when the user log in, only admin user will receive a mail to inform him that there is a security lake. Is that OK with you ?

@Davide (rev66) : I added '.pot' file.

@Stefan (rev67) : (about your last comment) Your idea works perfectly. I would never thought of that because I was lost in inheritance. Thanks a lot.

@Daniel (rev68) : I changed the algorithm to manage translatable emails.

I think that's all.

Regards.

[lp:~sylvain-legal/server-env-tools/7.0-auth_admin_passkey]

69. By Sylvain LE GAL (GRAP) on 2014-03-23

[MRG]

[Pedro Manuel Baeza (pedro.baeza)]

Hi Sylvain, another great contribution! Some remarks from a quick scan:

- Typos in description file:

s/Functionnalities/Functionality
s/Technical informations/Technical information

- I'm not sure about putting company information in description. We have author and website fields for that. What others think about it?

- On __init__.py, please use 'from . import xxx' form.

- Please respect PEP8 max line width (79 cols) in res_config.py (maybe with shorter field names).

- You can use self.pool['object.name'] instead of self.pool.get('object.name') to get a shorter form and exact traceback when a model doesn't exist.

-

review: Needs Fixing (code review)

[lp:~sylvain-legal/server-env-tools/7.0-auth_admin_passkey]

70. By Sylvain LE GAL (GRAP) on 2014-03-23

[REF] Pep8 and import conventions.

[Sylvain LE GAL (GRAP) (sylvain-legal)]

Hi Pedro,

Thanks for your review.
I did modifications about import & pep8.

About description in __openerp__.py file : In other modules, there is a big header with that kind of informations (company name, date, link to AGPL licences, people who wrote the module).
In my modules, I just put a light header in each file as you seen and put all the information in the description field.
So the number of lines is smaller and information are more visible. for exemple if someone has a question about a module he can contact the authors without downloading the module.

Regards.

[Stefan Rijnhart (Opener) (stefan-opener)]

Great, thanks!

review: Approve

[Davide Corio (enlightx-deactivatedaccount)]

review: Approve

[lp:~sylvain-legal/server-env-tools/7.0-auth_admin_passkey]

71. By Sylvain LE GAL (GRAP) on 2014-03-24

[FIX] res_config.py : incorrect call. self.pool('xxx') -> self.pool['xxx']
[REF] res_users.py : same call to self.pool in other res_users class.

[Yannick Vaucher @ Camptocamp (yvaucher-c2c)]

Correct me if I'm wrong but for license the Preamble is mandatory in each source file

Your headers don't seems compatible with AGPL to me.

http://www.gnu.org/licenses/gpl-faq.html#NoticeInSourceFile
http://www.gnu.org/licenses/gpl-faq.html#GPLOmitPreamble

review: Needs Information

[Yannick Vaucher @ Camptocamp (yvaucher-c2c)]

http://www.gnu.org/licenses/gpl-faq.html#WhyMustIInclude

[Sylvain LE GAL (GRAP) (sylvain-legal)]

Hi,

Thanks a lot for your review Yannick and your question.
First, I'm pretty beginner in OpenSource World, and I have no problem with changing the declaration of the copyright.

My point of view is :
- It's a pitty to make more heavy code source with a lot of Copyright code; Sometimes I review MP with 100 lines, but with only "5 functionnal lines";
- As people writing code, I don't like Copy / Paste, duplication, etc. "If you write something twice, write a function" I so consider that it's possible to just put in each file a reference to __openerp__.py file and in __openerp__.py file, just a link to the AGPL licence online; But I'm not a lawyer;
- If the licence / author change, I have to change all my files. It's not very efficient;
- Anyway, the source code is available on launchpad, and all the project is by default on AGPL. (defined here : https://launchpad.net/server-env-tools in License section);
- You say (and it is written in your links) that header is mandatory in each source file but OpenERP SA and Community don't respect that rule. Licence are just written in '.py' file and sometimes in '.js'. But what about 'xml', 'yml' ? There is no licences in this kind of files. But for me data/view/action/menu definitions are part of code.

Would you agree if I put the whole licence in __openerp__.py file and keep references in other files ?

(In any case, I will follow the opinion of the community on this issue.)

Regards.

[Pedro Manuel Baeza (pedro.baeza)]

Hi, Sylvain, I agree with your thoughts about reiteration on license agreement, so I think your initiative looks good to me, but we have to assure that there is no legal hole where somebody can use the software in forms not allowed by AGPL and have legal coverage due to our mistake or not correct burocracy form.

Why don't we get this topic to the community list?

Regards.

[Holger Brunn (Therp) (hbrunn)]

Very useful, thanks!

Some remarks though:

Generally, you don't need most of your backslashes (ie when in a bracketed term) - removing them improves readability imho

#30 it's Functionality (-n)
#353 openerp.tools.safe_eval.literal_eval would do the same thing
#388 I guess you want to safe the dependency on email.template here?
#390ff you use multiline strings without actually using them. Why?

Wouldn't it make sense to swap #451 and #454? The usual (and thus the one that should be the fastest) case will be that a user logs in with her own password.

And +1 for including the full license in every file

review: Needs Fixing

[lp:~sylvain-legal/server-env-tools/7.0-auth_admin_passkey]

72. By Sylvain LE GAL (GRAP) on 2014-03-27

[MRG]

73. By Sylvain LE GAL (GRAP) on 2014-03-31

[ADD] copyright information in all files.

74. By Sylvain LE GAL (GRAP) on 2014-03-31

[REF] Pep8.

75. By Sylvain LE GAL (GRAP) on 2014-03-31

[REF] change order in an algorithm;

76. By Sylvain LE GAL (GRAP) on 2014-03-31

[FIX] Incorrect import.

77. By Sylvain LE GAL (GRAP) on 2014-03-31

[REF] typo.

[Sylvain LE GAL (GRAP) (sylvain-legal)]

Hi Holger,

Thanks for your review. In order of your remarks:
- typo changed;

- About 'literal_eval' import, I just copied / pasted some of the code written in the file ./addons/auth_signup/res_users.py. But OK, I changed it.

- About 'email.template'. At the beginning, I just not wanted to manage translation... I added translation following remarks of reviewers. E-mail Template are not very easy to use in that case because I don't have a clear model related to the email_template. I wanna send informations of 'user_agent_env'. I'm not expert with email templates but It seems that I need a related persistent model (I mean, to call $object.xxx). Create a model just for that is a mess. Don't you think ?

- I executed too 'pep8' tool (I just discovered ;-) ) and everything seems correct now.

@Holger, Yannick :
- About Licences & copyright informations, I added them in all files.

@Pedro :
Topic on community list is a good Idea but I don't know very well AGPL concepts and I'm not comfortable speaking in english, so I let the idea to more expert people.

Regards.

[Holger Brunn (Therp) (hbrunn)]

How about my only substantial point about swapping #451 and #454?

Concerning the templates: You indeed need a persistent model for that, but in this case, res.users would be just fine I think

[Holger Brunn (Therp) (hbrunn)]

...nevermind, I saw you did that already

[Sylvain LE GAL (GRAP) (sylvain-legal)]

Hum :

1/ About the swap : Sorry, I did it. rev75 : http://bazaar.launchpad.net/~sylvain-legal/server-env-tools/7.0-auth_admin_passkey/revision/75

2/ About the template, The code sends an email like that :
"""
Admin user used his passkey to login with {login}.

Technicals informations belows :
- Login date : {login_date}
- base_location : {base_location}
- HTTP_HOST : {HTTP_HOST}
- REMOTE_ADDR : {REMOTE_ADDR}"""

(and all technical informations that can be found in 'user_agent_env'.) line #545

In an email template, how can I access to REMOTE_ADDR via res_users object ?
(Sorry if my question is not relevant).

[Holger Brunn (Therp) (hbrunn)]

In templates, you have access to the context passed to the send_mail function via the variable ctx, so you could put the extra information there. But well, forget about it, it's too much hassle for an email nobody is ever going to personalize anyways.

review: Approve

[Sylvain LE GAL (GRAP) (sylvain-legal)]

@Yannick, @Pedro :
Are you Ok with the changes I did ? If yes, can you update your status ?

@Holger,
Thanks for that information (about ctx access), I didn't know. (And Thanks to Stephan & You about your suggestions to improve algorithm & module compatibility).
Sharing modules takes time but it helps to learn a lot of things.

Regards.

[Weste (julien-weste)]

Nice one, very useful to free som memory in our head ;)
Nothing more to say about the code.

review: Approve

[Pedro Manuel Baeza (pedro.baeza)]

Hi, Sylvain, thanks for the changes.

Regards.

review: Approve (code review)

[David BEAL (ak) (davidbeal)]

Really good idea !
thanks

[Yannick Vaucher @ Camptocamp (yvaucher-c2c)]

In translation

> Mot de passe bris de glace

I would write "bris de glace" in quotes or replace it by "d'urgence" ou "de secours" voir "de récupération"

But I don't block the MP for this.

review: Approve

[lp:~sylvain-legal/server-env-tools/7.0-auth_admin_passkey]

78. By Sylvain LE GAL (GRAP) on 2014-04-02

[MRG]

79. By Sylvain LE GAL (GRAP) on 2014-04-02

[FIX] translation.

[Sylvain LE GAL (GRAP) (sylvain-legal)]

Hi yannick,

Thanks to update your review status. I put quote in the translation file.

@all : 7 approves, Thanks !

Regards.

=== added directory 'auth_admin_passkey'
=== added file 'auth_admin_passkey/__init__.py'
--- auth_admin_passkey/__init__.py	1970-01-01 00:00:00 +0000
+++ auth_admin_passkey/__init__.py	2014-04-02 16:03:13 +0000
@@ -0,0 +1,23 @@
+# -*- encoding: utf-8 -*-
+##############################################################################
+#
+#    Admin Passkey module for OpenERP
+#    Copyright (C) 2013-2014 GRAP (http://www.grap.coop)
+#    @author Sylvain LE GAL (https://twitter.com/legalsylvain)
+#
+#    This program is free software: you can redistribute it and/or modify
+#    it under the terms of the GNU Affero General Public License as
+#    published by the Free Software Foundation, either version 3 of the
+#    License, or (at your option) any later version.
+#
+#    This program is distributed in the hope that it will be useful,
+#    but WITHOUT ANY WARRANTY; without even the implied warranty of
+#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#    GNU Affero General Public License for more details.
+#
+#    You should have received a copy of the GNU Affero General Public License
+#    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#
+##############################################################################
+
+from . import model

=== added file 'auth_admin_passkey/__openerp__.py'
--- auth_admin_passkey/__openerp__.py	1970-01-01 00:00:00 +0000
+++ auth_admin_passkey/__openerp__.py	2014-04-02 16:03:13 +0000
@@ -0,0 +1,66 @@
+# -*- encoding: utf-8 -*-
+##############################################################################
+#
+#    Admin Passkey module for OpenERP
+#    Copyright (C) 2013-2014 GRAP (http://www.grap.coop)
+#    @author Sylvain LE GAL (https://twitter.com/legalsylvain)
+#
+#    This program is free software: you can redistribute it and/or modify
+#    it under the terms of the GNU Affero General Public License as
+#    published by the Free Software Foundation, either version 3 of the
+#    License, or (at your option) any later version.
+#
+#    This program is distributed in the hope that it will be useful,
+#    but WITHOUT ANY WARRANTY; without even the implied warranty of
+#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#    GNU Affero General Public License for more details.
+#
+#    You should have received a copy of the GNU Affero General Public License
+#    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#
+##############################################################################
+
+{
+    'name': 'Authentification - Admin Passkey',
+    'version': '2.1',
+    'category': 'base',
+    'description': """
+Admin password become a passkey for all active logins
+=====================================================
+
+Functionality :
+---------------
+    * Administrator has now the possibility to login in with any login;
+    * By default, OpenERP will send a mail to user and admin to indicate them;
+    * If a user and the admin have the same password, admin will be informed;
+
+Technical information :
+-----------------------
+    * Create two ir_config_parameter to enable / disable mail sending;
+
+Copyright, Author and Licence :
+-------------------------------
+    * Copyright : 2014, Groupement Régional Alimentaire de Proximité;
+    * Author : Sylvain LE GAL (https://twitter.com/legalsylvain);
+    * Licence : AGPL-3 (http://www.gnu.org/licenses/)
+    """,
+    'author': 'GRAP',
+    'website': 'http://www.grap.coop',
+    'license': 'AGPL-3',
+    'depends': [
+        'mail',
+        ],
+    'data': [
+        'data/ir_config_parameter.xml',
+        'view/res_config_view.xml',
+    ],
+    'demo': [],
+    'js': [],
+    'css': [],
+    'qweb': [],
+    'images': [],
+    'post_load': '',
+    'application': False,
+    'installable': True,
+    'auto_install': False,
+}

=== added directory 'auth_admin_passkey/data'
=== added file 'auth_admin_passkey/data/ir_config_parameter.xml'
--- auth_admin_passkey/data/ir_config_parameter.xml	1970-01-01 00:00:00 +0000
+++ auth_admin_passkey/data/ir_config_parameter.xml	2014-04-02 16:03:13 +0000
@@ -0,0 +1,34 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!-- ********************************************************************** -->
+<!--Admin Passkey module for OpenERP                                        -->
+<!--Copyright (C) 2013-2014 GRAP (http://www.grap.coop)                     -->
+<!--@author Sylvain LE GAL (https://twitter.com/legalsylvain)               -->
+
+<!--This program is free software: you can redistribute it and/or modify    -->
+<!--it under the terms of the GNU Affero General Public License as          -->
+<!--published by the Free Software Foundation, either version 3 of the      -->
+<!--License, or (at your option) any later version.                         -->
+
+<!--This program is distributed in the hope that it will be useful,         -->
+<!--but WITHOUT ANY WARRANTY; without even the implied warranty of          -->
+<!--MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the           -->
+<!--GNU Affero General Public License for more details.                     -->
+
+<!--You should have received a copy of the GNU Affero General Public License-->
+<!--along with this program.  If not, see <http://www.gnu.org/licenses/>.   -->
+<!-- ********************************************************************** -->
+<openerp>
+    <data noupdate="1">
+
+        <record id="send_to_admin" model="ir.config_parameter">
+            <field name="key">auth_admin_passkey.send_to_admin</field>
+            <field name="value">True</field>
+        </record>
+
+        <record id="send_to_user" model="ir.config_parameter">
+            <field name="key">auth_admin_passkey.send_to_user</field>
+            <field name="value">True</field>
+        </record>
+
+    </data>
+</openerp>

=== added directory 'auth_admin_passkey/i18n'
=== added file 'auth_admin_passkey/i18n/auth_admin_passkey.pot'
--- auth_admin_passkey/i18n/auth_admin_passkey.pot	1970-01-01 00:00:00 +0000
+++ auth_admin_passkey/i18n/auth_admin_passkey.pot	2014-04-02 16:03:13 +0000
@@ -0,0 +1,101 @@
+##############################################################################
+#
+#    Admin Passkey module for OpenERP
+#    Copyright (C) 2013-2014 GRAP (http://www.grap.coop)
+#    @author Sylvain LE GAL (https://twitter.com/legalsylvain)
+#
+#    This program is free software: you can redistribute it and/or modify
+#    it under the terms of the GNU Affero General Public License as
+#    published by the Free Software Foundation, either version 3 of the
+#    License, or (at your option) any later version.
+#
+#    This program is distributed in the hope that it will be useful,
+#    but WITHOUT ANY WARRANTY; without even the implied warranty of
+#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#    GNU Affero General Public License for more details.
+#
+#    You should have received a copy of the GNU Affero General Public License
+#    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#
+##############################################################################
+# Translation of OpenERP Server.
+# This file contains the translation of the following modules:
+#	* auth_admin_passkey
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: OpenERP Server 7.0\n"
+"Report-Msgid-Bugs-To: \n"
+"POT-Creation-Date: 2014-03-23 20:41+0000\n"
+"PO-Revision-Date: 2014-03-23 20:41+0000\n"
+"Last-Translator: <>\n"
+"Language-Team: \n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: \n"
+"Plural-Forms: \n"
+
+#. module: auth_admin_passkey
+#: code:addons/auth_admin_passkey/model/res_users.py:66
+#, python-format
+msgid "<pre>User with login '%s' has the same password as you.</pre>"
+msgstr ""
+
+#. module: auth_admin_passkey
+#: code:addons/auth_admin_passkey/model/res_users.py:44
+#, python-format
+msgid "Admin user used his passkey to login with '%s'.\n"
+"\n"
+"\n"
+"\n"
+"Technicals informations belows : \n"
+"\n"
+"- Login date : %s\n"
+"\n"
+""
+msgstr ""
+
+#. module: auth_admin_passkey
+#: view:base.config.settings:0
+msgid "Passkey"
+msgstr ""
+
+#. module: auth_admin_passkey
+#: code:addons/auth_admin_passkey/model/res_users.py:42
+#, python-format
+msgid "Passkey used"
+msgstr ""
+
+#. module: auth_admin_passkey
+#: field:base.config.settings,auth_admin_passkey_send_to_admin:0
+msgid "Send email to admin user."
+msgstr ""
+
+#. module: auth_admin_passkey
+#: field:base.config.settings,auth_admin_passkey_send_to_user:0
+msgid "Send email to user."
+msgstr ""
+
+#. module: auth_admin_passkey
+#: code:_description:0
+#: model:ir.model,name:auth_admin_passkey.model_res_users
+#, python-format
+msgid "Users"
+msgstr ""
+
+#. module: auth_admin_passkey
+#: help:base.config.settings,auth_admin_passkey_send_to_user:0
+msgid "When the administrator use his password to login in with a different account, OpenERP will send an email to the account user."
+msgstr ""
+
+#. module: auth_admin_passkey
+#: help:base.config.settings,auth_admin_passkey_send_to_admin:0
+msgid "When the administrator use his password to login in with a different account, OpenERP will send an email to the admin user."
+msgstr ""
+
+#. module: auth_admin_passkey
+#: code:addons/auth_admin_passkey/model/res_users.py:64
+#, python-format
+msgid "[WARNING] OpenERP Security Risk"
+msgstr ""
+

=== added file 'auth_admin_passkey/i18n/fr.po'
--- auth_admin_passkey/i18n/fr.po	1970-01-01 00:00:00 +0000
+++ auth_admin_passkey/i18n/fr.po	2014-04-02 16:03:13 +0000
@@ -0,0 +1,108 @@
+##############################################################################
+#
+#    Admin Passkey module for OpenERP
+#    Copyright (C) 2013-2014 GRAP (http://www.grap.coop)
+#    @author Sylvain LE GAL (https://twitter.com/legalsylvain)
+#
+#    This program is free software: you can redistribute it and/or modify
+#    it under the terms of the GNU Affero General Public License as
+#    published by the Free Software Foundation, either version 3 of the
+#    License, or (at your option) any later version.
+#
+#    This program is distributed in the hope that it will be useful,
+#    but WITHOUT ANY WARRANTY; without even the implied warranty of
+#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#    GNU Affero General Public License for more details.
+#
+#    You should have received a copy of the GNU Affero General Public License
+#    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#
+##############################################################################
+# Translation of OpenERP Server.
+# This file contains the translation of the following modules:
+#	* auth_admin_passkey
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: OpenERP Server 7.0\n"
+"Report-Msgid-Bugs-To: \n"
+"POT-Creation-Date: 2014-03-23 20:38+0000\n"
+"PO-Revision-Date: 2014-03-23 20:38+0000\n"
+"Last-Translator: <>\n"
+"Language-Team: \n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: \n"
+"Plural-Forms: \n"
+
+#. module: auth_admin_passkey
+#: code:addons/auth_admin_passkey/model/res_users.py:66
+#, python-format
+msgid "<pre>User with login '%s' has the same password as you.</pre>"
+msgstr "<pre>L'utilisateur dont l'identifiant est '%s' a le même mot de passe que vous.</pre>"
+
+#. module: auth_admin_passkey
+#: code:addons/auth_admin_passkey/model/res_users.py:44
+#, python-format
+msgid "Admin user used his passkey to login with '%s'.\n"
+"\n"
+"\n"
+"\n"
+"Technicals informations belows : \n"
+"\n"
+"- Login date : %s\n"
+"\n"
+""
+msgstr "L'administrateur a utilisé son mot de passe \"bris de glace\" pour s'identifier avec l'identifiant '%s'.\n"
+"\n"
+"\n"
+"\n"
+"Informations techniques ci-dessous : \n"
+"\n"
+"- Date d'authentification : %s\n"
+"\n"
+""
+
+#. module: auth_admin_passkey
+#: view:base.config.settings:0
+msgid "Passkey"
+msgstr "Mot de passe \"bris de glace\""
+
+#. module: auth_admin_passkey
+#: code:addons/auth_admin_passkey/model/res_users.py:42
+#, python-format
+msgid "Passkey used"
+msgstr "Mot de passe \"bris de glace\" utilisé"
+
+#. module: auth_admin_passkey
+#: field:base.config.settings,auth_admin_passkey_send_to_admin:0
+msgid "Send email to admin user."
+msgstr "Envoyer un email à l'administrateur."
+
+#. module: auth_admin_passkey
+#: field:base.config.settings,auth_admin_passkey_send_to_user:0
+msgid "Send email to user."
+msgstr "Envoyer un email à l'utilisateur."
+
+#. module: auth_admin_passkey
+#: code:_description:0
+#: model:ir.model,name:auth_admin_passkey.model_res_users
+#, python-format
+msgid "Users"
+msgstr "Utilisateurs"
+
+#. module: auth_admin_passkey
+#: help:base.config.settings,auth_admin_passkey_send_to_user:0
+msgid "When the administrator use his password to login in with a different account, OpenERP will send an email to the account user."
+msgstr "Quand l'administrateur utilise son mot de passe pour s'authentifier avec un compte différent, OpenERP lui enverra un mail."
+
+#. module: auth_admin_passkey
+#: help:base.config.settings,auth_admin_passkey_send_to_admin:0
+msgid "When the administrator use his password to login in with a different account, OpenERP will send an email to the admin user."
+msgstr "Quand l'administrateur utilise son mot de passe pour s'authentifier avec un compte différent, OpenERP enverra un mail à l'utilisateur."
+
+#. module: auth_admin_passkey
+#: code:addons/auth_admin_passkey/model/res_users.py:64
+#, python-format
+msgid "[WARNING] OpenERP Security Risk"
+msgstr "[WARNING] Faille de sécurité sur OpenERP"

=== added directory 'auth_admin_passkey/model'
=== added file 'auth_admin_passkey/model/__init__.py'
--- auth_admin_passkey/model/__init__.py	1970-01-01 00:00:00 +0000
+++ auth_admin_passkey/model/__init__.py	2014-04-02 16:03:13 +0000
@@ -0,0 +1,24 @@
+# -*- encoding: utf-8 -*-
+##############################################################################
+#
+#    Admin Passkey module for OpenERP
+#    Copyright (C) 2013-2014 GRAP (http://www.grap.coop)
+#    @author Sylvain LE GAL (https://twitter.com/legalsylvain)
+#
+#    This program is free software: you can redistribute it and/or modify
+#    it under the terms of the GNU Affero General Public License as
+#    published by the Free Software Foundation, either version 3 of the
+#    License, or (at your option) any later version.
+#
+#    This program is distributed in the hope that it will be useful,
+#    but WITHOUT ANY WARRANTY; without even the implied warranty of
+#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#    GNU Affero General Public License for more details.
+#
+#    You should have received a copy of the GNU Affero General Public License
+#    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#
+##############################################################################
+
+from . import res_config
+from . import res_users

=== added file 'auth_admin_passkey/model/res_config.py'
--- auth_admin_passkey/model/res_config.py	1970-01-01 00:00:00 +0000
+++ auth_admin_passkey/model/res_config.py	2014-04-02 16:03:13 +0000
@@ -0,0 +1,76 @@
+# -*- encoding: utf-8 -*-
+##############################################################################
+#
+#    Admin Passkey module for OpenERP
+#    Copyright (C) 2013-2014 GRAP (http://www.grap.coop)
+#    @author Sylvain LE GAL (https://twitter.com/legalsylvain)
+#
+#    This program is free software: you can redistribute it and/or modify
+#    it under the terms of the GNU Affero General Public License as
+#    published by the Free Software Foundation, either version 3 of the
+#    License, or (at your option) any later version.
+#
+#    This program is distributed in the hope that it will be useful,
+#    but WITHOUT ANY WARRANTY; without even the implied warranty of
+#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#    GNU Affero General Public License for more details.
+#
+#    You should have received a copy of the GNU Affero General Public License
+#    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#
+##############################################################################
+
+from openerp.osv import fields
+from openerp.osv.orm import TransientModel
+from openerp.tools.safe_eval import safe_eval
+
+
+class base_config_settings(TransientModel):
+    _inherit = 'base.config.settings'
+
+    # Getter / Setter Section
+    def get_default_auth_admin_passkey_send_to_admin(
+            self, cr, uid, ids, context=None):
+        icp = self.pool['ir.config_parameter']
+        return {
+            'auth_admin_passkey_send_to_admin': safe_eval(icp.get_param(
+                cr, uid, 'auth_admin_passkey.send_to_admin', 'True')),
+        }
+
+    def set_auth_admin_passkey_send_to_admin(self, cr, uid, ids, context=None):
+        config = self.browse(cr, uid, ids[0], context=context)
+        icp = self.pool['ir.config_parameter']
+        icp.set_param(
+            cr, uid, 'auth_admin_passkey.send_to_admin',
+            repr(config.auth_admin_passkey_send_to_admin))
+
+    def get_default_auth_admin_passkey_send_to_user(
+            self, cr, uid, ids, context=None):
+        icp = self.pool['ir.config_parameter']
+        return {
+            'auth_admin_passkey_send_to_user': safe_eval(icp.get_param(
+                cr, uid, 'auth_admin_passkey.send_to_user', 'True')),
+        }
+
+    def set_auth_admin_passkey_send_to_user(self, cr, uid, ids, context=None):
+        config = self.browse(cr, uid, ids[0], context=context)
+        icp = self.pool['ir.config_parameter']
+        icp.set_param(
+            cr, uid, 'auth_admin_passkey.send_to_user',
+            repr(config.auth_admin_passkey_send_to_user))
+
+    # Columns Section
+    _columns = {
+        'auth_admin_passkey_send_to_admin': fields.boolean(
+            'Send email to admin user.',
+            help="""When the administrator use his password to login in """
+            """with a different account, OpenERP will send an email """
+            """to the admin user.""",
+        ),
+        'auth_admin_passkey_send_to_user': fields.boolean(
+            string='Send email to user.',
+            help="""When the administrator use his password to login in """
+            """with a different account, OpenERP will send an email """
+            """to the account user.""",
+        ),
+    }

=== added file 'auth_admin_passkey/model/res_users.py'
--- auth_admin_passkey/model/res_users.py	1970-01-01 00:00:00 +0000
+++ auth_admin_passkey/model/res_users.py	2014-04-02 16:03:13 +0000
@@ -0,0 +1,137 @@
+# -*- encoding: utf-8 -*-
+##############################################################################
+#
+#    Admin Passkey module for OpenERP
+#    Copyright (C) 2013-2014 GRAP (http://www.grap.coop)
+#    @author Sylvain LE GAL (https://twitter.com/legalsylvain)
+#
+#    This program is free software: you can redistribute it and/or modify
+#    it under the terms of the GNU Affero General Public License as
+#    published by the Free Software Foundation, either version 3 of the
+#    License, or (at your option) any later version.
+#
+#    This program is distributed in the hope that it will be useful,
+#    but WITHOUT ANY WARRANTY; without even the implied warranty of
+#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#    GNU Affero General Public License for more details.
+#
+#    You should have received a copy of the GNU Affero General Public License
+#    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#
+##############################################################################
+
+import datetime
+
+from openerp import SUPERUSER_ID
+from openerp import pooler
+from openerp import exceptions
+from openerp.osv.orm import Model
+from openerp.tools.translate import _
+from openerp.tools.safe_eval import safe_eval
+
+
+class res_users(Model):
+    _inherit = "res.users"
+
+    # Private Function section
+    def _get_translation(self, cr, lang, text):
+        context = {'lang': lang}
+        return _(text)
+
+    def _send_email_passkey(self, cr, user_id, user_agent_env):
+        """ Send a email to the admin of the system and / or the user
+ to inform passkey use."""
+        mails = []
+        mail_obj = self.pool['mail.mail']
+        icp_obj = self.pool['ir.config_parameter']
+        admin_user = self.browse(cr, SUPERUSER_ID, SUPERUSER_ID)
+        login_user = self.browse(cr, SUPERUSER_ID, user_id)
+        send_to_admin = safe_eval(icp_obj.get_param(
+            cr, SUPERUSER_ID, 'auth_admin_passkey.send_to_admin', 'True'))
+        send_to_user = safe_eval(icp_obj.get_param(
+            cr, SUPERUSER_ID, 'auth_admin_passkey.send_to_user', 'True'))
+
+        if send_to_admin and admin_user.email:
+            mails.append({'email': admin_user.email, 'lang': admin_user.lang})
+        if send_to_user and login_user.email:
+            mails.append({'email': login_user.email, 'lang': login_user.lang})
+
+        for mail in mails:
+            subject = self._get_translation(
+                cr, mail['lang'], _('Passkey used'))
+            body = self._get_translation(
+                cr, mail['lang'],
+                _("""Admin user used his passkey to login with '%s'.\n\n"""
+                    """\n\nTechnicals informations belows : \n\n"""
+                    """- Login date : %s\n\n""")) % (
+                        login_user.login,
+                        datetime.datetime.now().strftime("%Y-%m-%d %H:%M:%S"))
+            for k, v in user_agent_env.iteritems():
+                body += ("- %s : %s\n\n") % (k, v)
+            mail_obj.create(
+                cr, SUPERUSER_ID, {
+                    'email_to': mail['email'],
+                    'subject': subject,
+                    'body_html': '<pre>%s</pre>' % body})
+
+    def _send_email_same_password(self, cr, login_user):
+        """ Send a email to the admin user to inform that another user has the
+ same password as him."""
+        mail_obj = self.pool['mail.mail']
+        admin_user = self.browse(cr, SUPERUSER_ID, SUPERUSER_ID)
+        if admin_user.email:
+            mail_obj.create(cr, SUPERUSER_ID, {
+                'email_to': admin_user.email,
+                'subject': self._get_translation(
+                    cr, admin_user.lang, _('[WARNING] OpenERP Security Risk')),
+                'body_html': self._get_translation(
+                    cr, admin_user.lang, _(
+                        """<pre>User with login '%s' has the same """
+                        """password as you.</pre>""")) % (login_user),
+            })
+
+    # Overload Section
+    def authenticate(self, db, login, password, user_agent_env):
+        """ Authenticate the user 'login' is password is ok or if
+ is admin password. In the second case, send mail to user and admin."""
+        user_id = super(res_users, self).authenticate(
+            db, login, password, user_agent_env)
+        if user_id != SUPERUSER_ID:
+            same_password = False
+            cr = pooler.get_db(db).cursor()
+            try:
+                # directly use parent 'check_credentials' function
+                # to really know if credentials are ok
+                # or if it was admin password
+                super(res_users, self).check_credentials(
+                    cr, SUPERUSER_ID, password)
+                try:
+                    # Test now if the user has the same password as admin user
+                    super(res_users, self).check_credentials(
+                        cr, user_id, password)
+                    same_password = True
+                except exceptions.AccessDenied:
+                    pass
+                if not same_password:
+                    self._send_email_passkey(cr, user_id, user_agent_env)
+                else:
+                    self._send_email_same_password(cr, login)
+                cr.commit()
+            except exceptions.AccessDenied:
+                pass
+            finally:
+                cr.close()
+        return user_id
+
+    def check_credentials(self, cr, uid, password):
+        """ Return now True if credentials are good OR if password is admin
+password."""
+        if uid != SUPERUSER_ID:
+            try:
+                super(res_users, self).check_credentials(
+                    cr, uid, password)
+                return True
+            except exceptions.AccessDenied:
+                return self.check_credentials(cr, SUPERUSER_ID, password)
+        else:
+            return super(res_users, self).check_credentials(cr, uid, password)

=== added directory 'auth_admin_passkey/static'
=== added directory 'auth_admin_passkey/static/src'
=== added directory 'auth_admin_passkey/static/src/img'
=== added file 'auth_admin_passkey/static/src/img/icon.png'
Binary files auth_admin_passkey/static/src/img/icon.png	1970-01-01 00:00:00 +0000 and auth_admin_passkey/static/src/img/icon.png	2014-04-02 16:03:13 +0000 differ
=== added directory 'auth_admin_passkey/view'
=== added file 'auth_admin_passkey/view/res_config_view.xml'
--- auth_admin_passkey/view/res_config_view.xml	1970-01-01 00:00:00 +0000
+++ auth_admin_passkey/view/res_config_view.xml	2014-04-02 16:03:13 +0000
@@ -0,0 +1,47 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!-- ********************************************************************** -->
+<!--Admin Passkey module for OpenERP                                        -->
+<!--Copyright (C) 2013-2014 GRAP (http://www.grap.coop)                     -->
+<!--@author Sylvain LE GAL (https://twitter.com/legalsylvain)               -->
+
+<!--This program is free software: you can redistribute it and/or modify    -->
+<!--it under the terms of the GNU Affero General Public License as          -->
+<!--published by the Free Software Foundation, either version 3 of the      -->
+<!--License, or (at your option) any later version.                         -->
+
+<!--This program is distributed in the hope that it will be useful,         -->
+<!--but WITHOUT ANY WARRANTY; without even the implied warranty of          -->
+<!--MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the           -->
+<!--GNU Affero General Public License for more details.                     -->
+
+<!--You should have received a copy of the GNU Affero General Public License-->
+<!--along with this program.  If not, see <http://www.gnu.org/licenses/>.   -->
+<!-- ********************************************************************** -->
+<openerp>
+    <data>
+
+        <record id="view_res_config_settings" model="ir.ui.view">
+            <field name="name">base.config.settings.view</field>
+            <field name="model">base.config.settings</field>
+            <field name="inherit_id" ref="base_setup.view_general_configuration"/>
+            <field name="arch" type="xml">
+                <xpath expr="//label[@string='Email']/.." position='after'>
+                    <group>
+                        <label for="id" string="Passkey"/>
+                        <div>
+                            <div>
+                                <field name="auth_admin_passkey_send_to_admin" class="oe_inline"/>
+                                <label for="auth_admin_passkey_send_to_admin"/>
+                            </div>
+                            <div>
+                                <field name="auth_admin_passkey_send_to_user" class="oe_inline"/>
+                                <label for="auth_admin_passkey_send_to_user"/>
+                            </div>
+                        </div>
+                    </group>
+                </xpath>
+            </field>
+        </record>
+
+    </data>
+</openerp>