Server Environment And Tools

Merge lp:~sylvain-legal/server-env-tools/7.0-auth_admin_passkey into lp:~server-env-tools-core-editors/server-env-tools/7.0

  1. 7.0-auth_admin_passkey
  2. Merge into 7.0
Proposed by Sylvain LE GAL (GRAP)
Status: Merged
Approved by: Yannick Vaucher @ Camptocamp
Approved revision: 79
Merged at revision: 69
Proposed branch: lp:~sylvain-legal/server-env-tools/7.0-auth_admin_passkey
Merge into: lp:~server-env-tools-core-editors/server-env-tools/7.0
Diff against target: 670 lines (+616/-0)
9 files modified
auth_admin_passkey/__init__.py (+23/-0)
auth_admin_passkey/__openerp__.py (+66/-0)
auth_admin_passkey/data/ir_config_parameter.xml (+34/-0)
auth_admin_passkey/i18n/auth_admin_passkey.pot (+101/-0)
auth_admin_passkey/i18n/fr.po (+108/-0)
auth_admin_passkey/model/__init__.py (+24/-0)
auth_admin_passkey/model/res_config.py (+76/-0)
auth_admin_passkey/model/res_users.py (+137/-0)
auth_admin_passkey/view/res_config_view.xml (+47/-0)
To merge this branch: bzr merge lp:~sylvain-legal/server-env-tools/7.0-auth_admin_passkey
Reviewer Review Type Date Requested Status
Yannick Vaucher @ Camptocamp Approve
Pedro Manuel Baeza code review Approve
Weste (community) Approve
Holger Brunn (Therp) Approve
Davide Corio (community) Approve
Stefan Rijnhart (Opener) Approve
Benoit Guillot - http://www.akretion.com (community) Approve
Review via email: mp+211338@code.launchpad.net

Commit message

[ADD] new module 'auth_admin_passkey' that allow admin user (uid=1) to login with any login and his password.

Description of the change

[ADD] new module 'auth_admin_passkey' that allow admin user (uid=1) to login with any login and his password.

To post a comment you must log in.
Revision history for this message
Stefan Rijnhart (Opener) (stefan-opener) wrote :

Great idea! The code looks good too. Thanks! Compatibility with auth_crypt is important, but if you say it can be done in a glue module we can leave it for someone to make this effort later on.

review: Approve
Revision history for this message
Davide Corio (enlightx-deactivatedaccount) wrote :

Thank you very much Sylvain!
And it works on trunk too.

review: Approve
Revision history for this message
Benoit Guillot - http://www.akretion.com (benoit-guillot-z) wrote :

Very useful !

review: Approve
Revision history for this message
Sylvain LE GAL (GRAP) (sylvain-legal) wrote :

Thanks for your reviews and for your interests.

@Stefan :
Sorry if was not clear : I'm not sure that is possible to do that with a glue module, and how. I just guess !
What I want :
- define in a predictive way the order of the call of the 2 functions : auth_crypt.res_users.check_credentials() and auth_admin_passkey.res_users.check_credentials()

What I know :
1/ I tested my module with 'auth_crypt' and it works depending of installation order (what I wrote in my description) ;
2/ I developed a glue module testing differents thinks like changing order of module in the __openerp__.py 'depends' value, but it didn't seem to work ;

Reference :
[Sep 2009] http://forum.openerp.com/forum/topic12962.html talk about alphabetic order but it contradicts my observation #1 ;
[2013] http://help.openerp.com/question/36392/how-openerp-decides-loading-order-of-modules/ talk about the order in 'depends' value but it contradicts my observation #2 ;

Dependencies tree (for your information) :
base : []
web : []
auth_crypt : ['base']
web_kanban : ['web']
base_setup : ['base', 'web_kanban']
mail : ['base', 'base_setup']
auth_admin_passkey : ['mail']

If somebody knows more about module order and how to manage that case ...

Regards.

Revision history for this message
Daniel Reis (dreis-pt) wrote :

Great work!

Nitpicks:

L103: could you add the .pot file?
L254-256: the body header text would be best as a single translatable string
L262: s/"Passkey used"/_("Passkey used")

Revision history for this message
Stefan Rijnhart (Opener) (stefan-opener) wrote :

Some more comments from my side:

Wild idea: in your override of check_credentials, why don't you first check if uid != SUPERUSER_ID and in that case don't call *super* but call self.check_credentials itself with the SUPERUSER_ID argument? This should fix compatibility with any authentication module.

Note that there is a small security risk in sending the emails to the unprivileged user: if such a user happens to have the same password as the administrator (it might just happen), they will receive an email that the adminitrator has logged on as themselves. They may then figure out that their password is the same as the administrator's, and they might then take advantage of that.

l.275: would it maybe make more sense if you check this condition *before* the try block in l.271?

review: Needs Information
Revision history for this message
Sylvain LE GAL (GRAP) (sylvain-legal) wrote :

Hi,

@Stefan,
Remarks 1 : I didn't understand what your 'wild' idea can fix. (about possible compatibility problem).

Remarks 2 : Héhé. Yes I thought of that very specific case without solution. I finally found a workaround to manage this case and I'll update the Merge Proposal in a while. (Work in progress again).

Remarks 3 : You're right. MP updated.

@Daniel :
Point 1 : Excuse my basic question but what is the interest to add '.pot' file. (I don't use it in my personal module).
Extra Question : How to generate it ? OpenERP only propose "po" / "csv" and "tgz". ".pot" file seems to be a ".po" file with empty traduction. It isn't ?

Point 2 : My code doesn't manage translation for the mails. (it is written in __openerp__.py), not because I did'nt call "_" function but because I haven't contextual information at this step. So the function "_" will not work. The workaround is to get language of each user. (normal & admin) requesting the database, update twice some context value, call "_" function ... I confess that I am not very motivated to write this code. But it can be the aim of a futur Merge Proposal.

Regards.

Revision history for this message
Davide Corio (enlightx-deactivatedaccount) wrote :

Daniel is right, pot file is missing (required as per community guide lines).
you just need to export the .po w/o selecting a specific language, then rename the file as your_module_name.pot and place it into the i18n folder.

review: Needs Fixing
Revision history for this message
Stefan Rijnhart (Opener) (stefan-opener) wrote :

Well the problem with auth_crypt is that the inheritance structure can be as follows:

-> auth_crypt -> auth_passkey -> base.

Authentication of regular user account with admin password fails in auth_crypt. Auth_crypt calls super(), which is this module's override. Regular authentication of the user account with the admin password fails. You then call super() with the SUPERUSER_ID which fails because the password is encrypted. If you call self.check_credentials from your self_credentials override, then you pass through auth_crypt again which now succesfully authenticates the administrator account. Or not, but then you don't call self.check_credentials but super instead because uid is already SUPERUSER_ID.

lp:~sylvain-legal/server-env-tools/7.0-auth_admin_passkey updated
67. By Sylvain LE GAL (GRAP)

[IMP] 'auth_admin_passkey' works now indepently from the order of the installation of modules 'auth_admin_passkey' and 'auth_crypt'. (Courtesy of Stefan Rijnhart).

68. By Sylvain LE GAL (GRAP)

[IMP] Emails are now translated.

Revision history for this message
Sylvain LE GAL (GRAP) (sylvain-legal) wrote :

@Stefan (rev65) : (about remark #2) I updated the algorithm to manage the special case where admin and user has the same password. In that case, when the user log in, only admin user will receive a mail to inform him that there is a security lake. Is that OK with you ?

@Davide (rev66) : I added '.pot' file.

@Stefan (rev67) : (about your last comment) Your idea works perfectly. I would never thought of that because I was lost in inheritance. Thanks a lot.

@Daniel (rev68) : I changed the algorithm to manage translatable emails.

I think that's all.

Regards.

lp:~sylvain-legal/server-env-tools/7.0-auth_admin_passkey updated
69. By Sylvain LE GAL (GRAP)

[MRG]

Revision history for this message
Pedro Manuel Baeza (pedro.baeza) wrote :

Hi Sylvain, another great contribution! Some remarks from a quick scan:

- Typos in description file:

s/Functionnalities/Functionality
s/Technical informations/Technical information

- I'm not sure about putting company information in description. We have author and website fields for that. What others think about it?

- On __init__.py, please use 'from . import xxx' form.

- Please respect PEP8 max line width (79 cols) in res_config.py (maybe with shorter field names).

- You can use self.pool['object.name'] instead of self.pool.get('object.name') to get a shorter form and exact traceback when a model doesn't exist.

-

review: Needs Fixing (code review)
lp:~sylvain-legal/server-env-tools/7.0-auth_admin_passkey updated
70. By Sylvain LE GAL (GRAP)

[REF] Pep8 and import conventions.

Revision history for this message
Sylvain LE GAL (GRAP) (sylvain-legal) wrote :

Hi Pedro,

Thanks for your review.
I did modifications about import & pep8.

About description in __openerp__.py file : In other modules, there is a big header with that kind of informations (company name, date, link to AGPL licences, people who wrote the module).
In my modules, I just put a light header in each file as you seen and put all the information in the description field.
So the number of lines is smaller and information are more visible. for exemple if someone has a question about a module he can contact the authors without downloading the module.

Regards.

Revision history for this message
Stefan Rijnhart (Opener) (stefan-opener) wrote :

Great, thanks!

review: Approve
Revision history for this message
Davide Corio (enlightx-deactivatedaccount) :
review: Approve
lp:~sylvain-legal/server-env-tools/7.0-auth_admin_passkey updated
71. By Sylvain LE GAL (GRAP)

[FIX] res_config.py : incorrect call. self.pool('xxx') -> self.pool['xxx']
[REF] res_users.py : same call to self.pool in other res_users class.

Revision history for this message
Yannick Vaucher @ Camptocamp (yvaucher-c2c) wrote :

Correct me if I'm wrong but for license the Preamble is mandatory in each source file

Your headers don't seems compatible with AGPL to me.

http://www.gnu.org/licenses/gpl-faq.html#NoticeInSourceFile
http://www.gnu.org/licenses/gpl-faq.html#GPLOmitPreamble

review: Needs Information
Revision history for this message
Yannick Vaucher @ Camptocamp (yvaucher-c2c) wrote :

http://www.gnu.org/licenses/gpl-faq.html#WhyMustIInclude

Revision history for this message
Sylvain LE GAL (GRAP) (sylvain-legal) wrote :

Hi,

Thanks a lot for your review Yannick and your question.
First, I'm pretty beginner in OpenSource World, and I have no problem with changing the declaration of the copyright.

My point of view is :
- It's a pitty to make more heavy code source with a lot of Copyright code; Sometimes I review MP with 100 lines, but with only "5 functionnal lines";
- As people writing code, I don't like Copy / Paste, duplication, etc. "If you write something twice, write a function" I so consider that it's possible to just put in each file a reference to __openerp__.py file and in __openerp__.py file, just a link to the AGPL licence online; But I'm not a lawyer;
- If the licence / author change, I have to change all my files. It's not very efficient;
- Anyway, the source code is available on launchpad, and all the project is by default on AGPL. (defined here : https://launchpad.net/server-env-tools in License section);
- You say (and it is written in your links) that header is mandatory in each source file but OpenERP SA and Community don't respect that rule. Licence are just written in '.py' file and sometimes in '.js'. But what about 'xml', 'yml' ? There is no licences in this kind of files. But for me data/view/action/menu definitions are part of code.

Would you agree if I put the whole licence in __openerp__.py file and keep references in other files ?

(In any case, I will follow the opinion of the community on this issue.)

Regards.

Revision history for this message
Pedro Manuel Baeza (pedro.baeza) wrote :

Hi, Sylvain, I agree with your thoughts about reiteration on license agreement, so I think your initiative looks good to me, but we have to assure that there is no legal hole where somebody can use the software in forms not allowed by AGPL and have legal coverage due to our mistake or not correct burocracy form.

Why don't we get this topic to the community list?

Regards.

Revision history for this message
Holger Brunn (Therp) (hbrunn) wrote :

Very useful, thanks!

Some remarks though:

Generally, you don't need most of your backslashes (ie when in a bracketed term) - removing them improves readability imho

#30 it's Functionality (-n)
#353 openerp.tools.safe_eval.literal_eval would do the same thing
#388 I guess you want to safe the dependency on email.template here?
#390ff you use multiline strings without actually using them. Why?

Wouldn't it make sense to swap #451 and #454? The usual (and thus the one that should be the fastest) case will be that a user logs in with her own password.

And +1 for including the full license in every file

review: Needs Fixing
lp:~sylvain-legal/server-env-tools/7.0-auth_admin_passkey updated
72. By Sylvain LE GAL (GRAP)

[MRG]

73. By Sylvain LE GAL (GRAP)

[ADD] copyright information in all files.

74. By Sylvain LE GAL (GRAP)

[REF] Pep8.

75. By Sylvain LE GAL (GRAP)

[REF] change order in an algorithm;

76. By Sylvain LE GAL (GRAP)

[FIX] Incorrect import.

77. By Sylvain LE GAL (GRAP)

[REF] typo.

Revision history for this message
Sylvain LE GAL (GRAP) (sylvain-legal) wrote :

Hi Holger,

Thanks for your review. In order of your remarks:
- typo changed;

- About 'literal_eval' import, I just copied / pasted some of the code written in the file ./addons/auth_signup/res_users.py. But OK, I changed it.

- About 'email.template'. At the beginning, I just not wanted to manage translation... I added translation following remarks of reviewers. E-mail Template are not very easy to use in that case because I don't have a clear model related to the email_template. I wanna send informations of 'user_agent_env'. I'm not expert with email templates but It seems that I need a related persistent model (I mean, to call $object.xxx). Create a model just for that is a mess. Don't you think ?

- I executed too 'pep8' tool (I just discovered ;-) ) and everything seems correct now.

@Holger, Yannick :
- About Licences & copyright informations, I added them in all files.

@Pedro :
Topic on community list is a good Idea but I don't know very well AGPL concepts and I'm not comfortable speaking in english, so I let the idea to more expert people.

Regards.

Revision history for this message
Holger Brunn (Therp) (hbrunn) wrote :

How about my only substantial point about swapping #451 and #454?

Concerning the templates: You indeed need a persistent model for that, but in this case, res.users would be just fine I think

Revision history for this message
Holger Brunn (Therp) (hbrunn) wrote :

...nevermind, I saw you did that already

Revision history for this message
Sylvain LE GAL (GRAP) (sylvain-legal) wrote :

Hum :

1/ About the swap : Sorry, I did it. rev75 : http://bazaar.launchpad.net/~sylvain-legal/server-env-tools/7.0-auth_admin_passkey/revision/75

2/ About the template, The code sends an email like that :
"""
Admin user used his passkey to login with {login}.

Technicals informations belows :
- Login date : {login_date}
- base_location : {base_location}
- HTTP_HOST : {HTTP_HOST}
- REMOTE_ADDR : {REMOTE_ADDR}"""

(and all technical informations that can be found in 'user_agent_env'.) line #545

In an email template, how can I access to REMOTE_ADDR via res_users object ?
(Sorry if my question is not relevant).

Revision history for this message
Holger Brunn (Therp) (hbrunn) wrote :

In templates, you have access to the context passed to the send_mail function via the variable ctx, so you could put the extra information there. But well, forget about it, it's too much hassle for an email nobody is ever going to personalize anyways.

review: Approve
Revision history for this message
Sylvain LE GAL (GRAP) (sylvain-legal) wrote :

@Yannick, @Pedro :
Are you Ok with the changes I did ? If yes, can you update your status ?

@Holger,
Thanks for that information (about ctx access), I didn't know. (And Thanks to Stephan & You about your suggestions to improve algorithm & module compatibility).
Sharing modules takes time but it helps to learn a lot of things.

Regards.

Revision history for this message
Weste (julien-weste) wrote :

Nice one, very useful to free som memory in our head ;)
Nothing more to say about the code.

review: Approve
Revision history for this message
Pedro Manuel Baeza (pedro.baeza) wrote :

Hi, Sylvain, thanks for the changes.

Regards.

review: Approve (code review)
Revision history for this message
David BEAL (ak) (davidbeal) wrote :

Really good idea !
thanks

Revision history for this message
Yannick Vaucher @ Camptocamp (yvaucher-c2c) wrote :

In translation

> Mot de passe bris de glace

I would write "bris de glace" in quotes or replace it by "d'urgence" ou "de secours" voir "de récupération"

But I don't block the MP for this.

review: Approve
lp:~sylvain-legal/server-env-tools/7.0-auth_admin_passkey updated
78. By Sylvain LE GAL (GRAP)

[MRG]

79. By Sylvain LE GAL (GRAP)

[FIX] translation.

Revision history for this message
Sylvain LE GAL (GRAP) (sylvain-legal) wrote :

Hi yannick,

Thanks to update your review status. I put quote in the translation file.

@all : 7 approves, Thanks !

Regards.

Preview Diff

[H/L] Next/Prev Comment, [J/K] Next/Prev File, [N/P] Next/Prev Hunk
=== added directory 'auth_admin_passkey'
=== added file 'auth_admin_passkey/__init__.py'
--- auth_admin_passkey/__init__.py 1970-01-01 00:00:00 +0000
+++ auth_admin_passkey/__init__.py 2014-04-02 16:03:13 +0000
@@ -0,0 +1,23 @@
1# -*- encoding: utf-8 -*-
2##############################################################################
3#
4# Admin Passkey module for OpenERP
5# Copyright (C) 2013-2014 GRAP (http://www.grap.coop)
6# @author Sylvain LE GAL (https://twitter.com/legalsylvain)
7#
8# This program is free software: you can redistribute it and/or modify
9# it under the terms of the GNU Affero General Public License as
10# published by the Free Software Foundation, either version 3 of the
11# License, or (at your option) any later version.
12#
13# This program is distributed in the hope that it will be useful,
14# but WITHOUT ANY WARRANTY; without even the implied warranty of
15# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16# GNU Affero General Public License for more details.
17#
18# You should have received a copy of the GNU Affero General Public License
19# along with this program. If not, see <http://www.gnu.org/licenses/>.
20#
21##############################################################################
22
23from . import model
024
=== added file 'auth_admin_passkey/__openerp__.py'
--- auth_admin_passkey/__openerp__.py 1970-01-01 00:00:00 +0000
+++ auth_admin_passkey/__openerp__.py 2014-04-02 16:03:13 +0000
@@ -0,0 +1,66 @@
1# -*- encoding: utf-8 -*-
2##############################################################################
3#
4# Admin Passkey module for OpenERP
5# Copyright (C) 2013-2014 GRAP (http://www.grap.coop)
6# @author Sylvain LE GAL (https://twitter.com/legalsylvain)
7#
8# This program is free software: you can redistribute it and/or modify
9# it under the terms of the GNU Affero General Public License as
10# published by the Free Software Foundation, either version 3 of the
11# License, or (at your option) any later version.
12#
13# This program is distributed in the hope that it will be useful,
14# but WITHOUT ANY WARRANTY; without even the implied warranty of
15# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16# GNU Affero General Public License for more details.
17#
18# You should have received a copy of the GNU Affero General Public License
19# along with this program. If not, see <http://www.gnu.org/licenses/>.
20#
21##############################################################################
22
23{
24 'name': 'Authentification - Admin Passkey',
25 'version': '2.1',
26 'category': 'base',
27 'description': """
28Admin password become a passkey for all active logins
29=====================================================
30
31Functionality :
32---------------
33 * Administrator has now the possibility to login in with any login;
34 * By default, OpenERP will send a mail to user and admin to indicate them;
35 * If a user and the admin have the same password, admin will be informed;
36
37Technical information :
38-----------------------
39 * Create two ir_config_parameter to enable / disable mail sending;
40
41Copyright, Author and Licence :
42-------------------------------
43 * Copyright : 2014, Groupement Régional Alimentaire de Proximité;
44 * Author : Sylvain LE GAL (https://twitter.com/legalsylvain);
45 * Licence : AGPL-3 (http://www.gnu.org/licenses/)
46 """,
47 'author': 'GRAP',
48 'website': 'http://www.grap.coop',
49 'license': 'AGPL-3',
50 'depends': [
51 'mail',
52 ],
53 'data': [
54 'data/ir_config_parameter.xml',
55 'view/res_config_view.xml',
56 ],
57 'demo': [],
58 'js': [],
59 'css': [],
60 'qweb': [],
61 'images': [],
62 'post_load': '',
63 'application': False,
64 'installable': True,
65 'auto_install': False,
66}
067
=== added directory 'auth_admin_passkey/data'
=== added file 'auth_admin_passkey/data/ir_config_parameter.xml'
--- auth_admin_passkey/data/ir_config_parameter.xml 1970-01-01 00:00:00 +0000
+++ auth_admin_passkey/data/ir_config_parameter.xml 2014-04-02 16:03:13 +0000
@@ -0,0 +1,34 @@
1<?xml version="1.0" encoding="UTF-8"?>
2<!-- ********************************************************************** -->
3<!--Admin Passkey module for OpenERP -->
4<!--Copyright (C) 2013-2014 GRAP (http://www.grap.coop) -->
5<!--@author Sylvain LE GAL (https://twitter.com/legalsylvain) -->
6
7<!--This program is free software: you can redistribute it and/or modify -->
8<!--it under the terms of the GNU Affero General Public License as -->
9<!--published by the Free Software Foundation, either version 3 of the -->
10<!--License, or (at your option) any later version. -->
11
12<!--This program is distributed in the hope that it will be useful, -->
13<!--but WITHOUT ANY WARRANTY; without even the implied warranty of -->
14<!--MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -->
15<!--GNU Affero General Public License for more details. -->
16
17<!--You should have received a copy of the GNU Affero General Public License-->
18<!--along with this program. If not, see <http://www.gnu.org/licenses/>. -->
19<!-- ********************************************************************** -->
20<openerp>
21 <data noupdate="1">
22
23 <record id="send_to_admin" model="ir.config_parameter">
24 <field name="key">auth_admin_passkey.send_to_admin</field>
25 <field name="value">True</field>
26 </record>
27
28 <record id="send_to_user" model="ir.config_parameter">
29 <field name="key">auth_admin_passkey.send_to_user</field>
30 <field name="value">True</field>
31 </record>
32
33 </data>
34</openerp>
035
=== added directory 'auth_admin_passkey/i18n'
=== added file 'auth_admin_passkey/i18n/auth_admin_passkey.pot'
--- auth_admin_passkey/i18n/auth_admin_passkey.pot 1970-01-01 00:00:00 +0000
+++ auth_admin_passkey/i18n/auth_admin_passkey.pot 2014-04-02 16:03:13 +0000
@@ -0,0 +1,101 @@
1##############################################################################
2#
3# Admin Passkey module for OpenERP
4# Copyright (C) 2013-2014 GRAP (http://www.grap.coop)
5# @author Sylvain LE GAL (https://twitter.com/legalsylvain)
6#
7# This program is free software: you can redistribute it and/or modify
8# it under the terms of the GNU Affero General Public License as
9# published by the Free Software Foundation, either version 3 of the
10# License, or (at your option) any later version.
11#
12# This program is distributed in the hope that it will be useful,
13# but WITHOUT ANY WARRANTY; without even the implied warranty of
14# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15# GNU Affero General Public License for more details.
16#
17# You should have received a copy of the GNU Affero General Public License
18# along with this program. If not, see <http://www.gnu.org/licenses/>.
19#
20##############################################################################
21# Translation of OpenERP Server.
22# This file contains the translation of the following modules:
23# * auth_admin_passkey
24#
25msgid ""
26msgstr ""
27"Project-Id-Version: OpenERP Server 7.0\n"
28"Report-Msgid-Bugs-To: \n"
29"POT-Creation-Date: 2014-03-23 20:41+0000\n"
30"PO-Revision-Date: 2014-03-23 20:41+0000\n"
31"Last-Translator: <>\n"
32"Language-Team: \n"
33"MIME-Version: 1.0\n"
34"Content-Type: text/plain; charset=UTF-8\n"
35"Content-Transfer-Encoding: \n"
36"Plural-Forms: \n"
37
38#. module: auth_admin_passkey
39#: code:addons/auth_admin_passkey/model/res_users.py:66
40#, python-format
41msgid "<pre>User with login '%s' has the same password as you.</pre>"
42msgstr ""
43
44#. module: auth_admin_passkey
45#: code:addons/auth_admin_passkey/model/res_users.py:44
46#, python-format
47msgid "Admin user used his passkey to login with '%s'.\n"
48"\n"
49"\n"
50"\n"
51"Technicals informations belows : \n"
52"\n"
53"- Login date : %s\n"
54"\n"
55""
56msgstr ""
57
58#. module: auth_admin_passkey
59#: view:base.config.settings:0
60msgid "Passkey"
61msgstr ""
62
63#. module: auth_admin_passkey
64#: code:addons/auth_admin_passkey/model/res_users.py:42
65#, python-format
66msgid "Passkey used"
67msgstr ""
68
69#. module: auth_admin_passkey
70#: field:base.config.settings,auth_admin_passkey_send_to_admin:0
71msgid "Send email to admin user."
72msgstr ""
73
74#. module: auth_admin_passkey
75#: field:base.config.settings,auth_admin_passkey_send_to_user:0
76msgid "Send email to user."
77msgstr ""
78
79#. module: auth_admin_passkey
80#: code:_description:0
81#: model:ir.model,name:auth_admin_passkey.model_res_users
82#, python-format
83msgid "Users"
84msgstr ""
85
86#. module: auth_admin_passkey
87#: help:base.config.settings,auth_admin_passkey_send_to_user:0
88msgid "When the administrator use his password to login in with a different account, OpenERP will send an email to the account user."
89msgstr ""
90
91#. module: auth_admin_passkey
92#: help:base.config.settings,auth_admin_passkey_send_to_admin:0
93msgid "When the administrator use his password to login in with a different account, OpenERP will send an email to the admin user."
94msgstr ""
95
96#. module: auth_admin_passkey
97#: code:addons/auth_admin_passkey/model/res_users.py:64
98#, python-format
99msgid "[WARNING] OpenERP Security Risk"
100msgstr ""
101
0102
=== added file 'auth_admin_passkey/i18n/fr.po'
--- auth_admin_passkey/i18n/fr.po 1970-01-01 00:00:00 +0000
+++ auth_admin_passkey/i18n/fr.po 2014-04-02 16:03:13 +0000
@@ -0,0 +1,108 @@
1##############################################################################
2#
3# Admin Passkey module for OpenERP
4# Copyright (C) 2013-2014 GRAP (http://www.grap.coop)
5# @author Sylvain LE GAL (https://twitter.com/legalsylvain)
6#
7# This program is free software: you can redistribute it and/or modify
8# it under the terms of the GNU Affero General Public License as
9# published by the Free Software Foundation, either version 3 of the
10# License, or (at your option) any later version.
11#
12# This program is distributed in the hope that it will be useful,
13# but WITHOUT ANY WARRANTY; without even the implied warranty of
14# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15# GNU Affero General Public License for more details.
16#
17# You should have received a copy of the GNU Affero General Public License
18# along with this program. If not, see <http://www.gnu.org/licenses/>.
19#
20##############################################################################
21# Translation of OpenERP Server.
22# This file contains the translation of the following modules:
23# * auth_admin_passkey
24#
25msgid ""
26msgstr ""
27"Project-Id-Version: OpenERP Server 7.0\n"
28"Report-Msgid-Bugs-To: \n"
29"POT-Creation-Date: 2014-03-23 20:38+0000\n"
30"PO-Revision-Date: 2014-03-23 20:38+0000\n"
31"Last-Translator: <>\n"
32"Language-Team: \n"
33"MIME-Version: 1.0\n"
34"Content-Type: text/plain; charset=UTF-8\n"
35"Content-Transfer-Encoding: \n"
36"Plural-Forms: \n"
37
38#. module: auth_admin_passkey
39#: code:addons/auth_admin_passkey/model/res_users.py:66
40#, python-format
41msgid "<pre>User with login '%s' has the same password as you.</pre>"
42msgstr "<pre>L'utilisateur dont l'identifiant est '%s' a le même mot de passe que vous.</pre>"
43
44#. module: auth_admin_passkey
45#: code:addons/auth_admin_passkey/model/res_users.py:44
46#, python-format
47msgid "Admin user used his passkey to login with '%s'.\n"
48"\n"
49"\n"
50"\n"
51"Technicals informations belows : \n"
52"\n"
53"- Login date : %s\n"
54"\n"
55""
56msgstr "L'administrateur a utilisé son mot de passe \"bris de glace\" pour s'identifier avec l'identifiant '%s'.\n"
57"\n"
58"\n"
59"\n"
60"Informations techniques ci-dessous : \n"
61"\n"
62"- Date d'authentification : %s\n"
63"\n"
64""
65
66#. module: auth_admin_passkey
67#: view:base.config.settings:0
68msgid "Passkey"
69msgstr "Mot de passe \"bris de glace\""
70
71#. module: auth_admin_passkey
72#: code:addons/auth_admin_passkey/model/res_users.py:42
73#, python-format
74msgid "Passkey used"
75msgstr "Mot de passe \"bris de glace\" utilisé"
76
77#. module: auth_admin_passkey
78#: field:base.config.settings,auth_admin_passkey_send_to_admin:0
79msgid "Send email to admin user."
80msgstr "Envoyer un email à l'administrateur."
81
82#. module: auth_admin_passkey
83#: field:base.config.settings,auth_admin_passkey_send_to_user:0
84msgid "Send email to user."
85msgstr "Envoyer un email à l'utilisateur."
86
87#. module: auth_admin_passkey
88#: code:_description:0
89#: model:ir.model,name:auth_admin_passkey.model_res_users
90#, python-format
91msgid "Users"
92msgstr "Utilisateurs"
93
94#. module: auth_admin_passkey
95#: help:base.config.settings,auth_admin_passkey_send_to_user:0
96msgid "When the administrator use his password to login in with a different account, OpenERP will send an email to the account user."
97msgstr "Quand l'administrateur utilise son mot de passe pour s'authentifier avec un compte différent, OpenERP lui enverra un mail."
98
99#. module: auth_admin_passkey
100#: help:base.config.settings,auth_admin_passkey_send_to_admin:0
101msgid "When the administrator use his password to login in with a different account, OpenERP will send an email to the admin user."
102msgstr "Quand l'administrateur utilise son mot de passe pour s'authentifier avec un compte différent, OpenERP enverra un mail à l'utilisateur."
103
104#. module: auth_admin_passkey
105#: code:addons/auth_admin_passkey/model/res_users.py:64
106#, python-format
107msgid "[WARNING] OpenERP Security Risk"
108msgstr "[WARNING] Faille de sécurité sur OpenERP"
0109
=== added directory 'auth_admin_passkey/model'
=== added file 'auth_admin_passkey/model/__init__.py'
--- auth_admin_passkey/model/__init__.py 1970-01-01 00:00:00 +0000
+++ auth_admin_passkey/model/__init__.py 2014-04-02 16:03:13 +0000
@@ -0,0 +1,24 @@
1# -*- encoding: utf-8 -*-
2##############################################################################
3#
4# Admin Passkey module for OpenERP
5# Copyright (C) 2013-2014 GRAP (http://www.grap.coop)
6# @author Sylvain LE GAL (https://twitter.com/legalsylvain)
7#
8# This program is free software: you can redistribute it and/or modify
9# it under the terms of the GNU Affero General Public License as
10# published by the Free Software Foundation, either version 3 of the
11# License, or (at your option) any later version.
12#
13# This program is distributed in the hope that it will be useful,
14# but WITHOUT ANY WARRANTY; without even the implied warranty of
15# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16# GNU Affero General Public License for more details.
17#
18# You should have received a copy of the GNU Affero General Public License
19# along with this program. If not, see <http://www.gnu.org/licenses/>.
20#
21##############################################################################
22
23from . import res_config
24from . import res_users
025
=== added file 'auth_admin_passkey/model/res_config.py'
--- auth_admin_passkey/model/res_config.py 1970-01-01 00:00:00 +0000
+++ auth_admin_passkey/model/res_config.py 2014-04-02 16:03:13 +0000
@@ -0,0 +1,76 @@
1# -*- encoding: utf-8 -*-
2##############################################################################
3#
4# Admin Passkey module for OpenERP
5# Copyright (C) 2013-2014 GRAP (http://www.grap.coop)
6# @author Sylvain LE GAL (https://twitter.com/legalsylvain)
7#
8# This program is free software: you can redistribute it and/or modify
9# it under the terms of the GNU Affero General Public License as
10# published by the Free Software Foundation, either version 3 of the
11# License, or (at your option) any later version.
12#
13# This program is distributed in the hope that it will be useful,
14# but WITHOUT ANY WARRANTY; without even the implied warranty of
15# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16# GNU Affero General Public License for more details.
17#
18# You should have received a copy of the GNU Affero General Public License
19# along with this program. If not, see <http://www.gnu.org/licenses/>.
20#
21##############################################################################
22
23from openerp.osv import fields
24from openerp.osv.orm import TransientModel
25from openerp.tools.safe_eval import safe_eval
26
27
28class base_config_settings(TransientModel):
29 _inherit = 'base.config.settings'
30
31 # Getter / Setter Section
32 def get_default_auth_admin_passkey_send_to_admin(
33 self, cr, uid, ids, context=None):
34 icp = self.pool['ir.config_parameter']
35 return {
36 'auth_admin_passkey_send_to_admin': safe_eval(icp.get_param(
37 cr, uid, 'auth_admin_passkey.send_to_admin', 'True')),
38 }
39
40 def set_auth_admin_passkey_send_to_admin(self, cr, uid, ids, context=None):
41 config = self.browse(cr, uid, ids[0], context=context)
42 icp = self.pool['ir.config_parameter']
43 icp.set_param(
44 cr, uid, 'auth_admin_passkey.send_to_admin',
45 repr(config.auth_admin_passkey_send_to_admin))
46
47 def get_default_auth_admin_passkey_send_to_user(
48 self, cr, uid, ids, context=None):
49 icp = self.pool['ir.config_parameter']
50 return {
51 'auth_admin_passkey_send_to_user': safe_eval(icp.get_param(
52 cr, uid, 'auth_admin_passkey.send_to_user', 'True')),
53 }
54
55 def set_auth_admin_passkey_send_to_user(self, cr, uid, ids, context=None):
56 config = self.browse(cr, uid, ids[0], context=context)
57 icp = self.pool['ir.config_parameter']
58 icp.set_param(
59 cr, uid, 'auth_admin_passkey.send_to_user',
60 repr(config.auth_admin_passkey_send_to_user))
61
62 # Columns Section
63 _columns = {
64 'auth_admin_passkey_send_to_admin': fields.boolean(
65 'Send email to admin user.',
66 help="""When the administrator use his password to login in """
67 """with a different account, OpenERP will send an email """
68 """to the admin user.""",
69 ),
70 'auth_admin_passkey_send_to_user': fields.boolean(
71 string='Send email to user.',
72 help="""When the administrator use his password to login in """
73 """with a different account, OpenERP will send an email """
74 """to the account user.""",
75 ),
76 }
077
=== added file 'auth_admin_passkey/model/res_users.py'
--- auth_admin_passkey/model/res_users.py 1970-01-01 00:00:00 +0000
+++ auth_admin_passkey/model/res_users.py 2014-04-02 16:03:13 +0000
@@ -0,0 +1,137 @@
1# -*- encoding: utf-8 -*-
2##############################################################################
3#
4# Admin Passkey module for OpenERP
5# Copyright (C) 2013-2014 GRAP (http://www.grap.coop)
6# @author Sylvain LE GAL (https://twitter.com/legalsylvain)
7#
8# This program is free software: you can redistribute it and/or modify
9# it under the terms of the GNU Affero General Public License as
10# published by the Free Software Foundation, either version 3 of the
11# License, or (at your option) any later version.
12#
13# This program is distributed in the hope that it will be useful,
14# but WITHOUT ANY WARRANTY; without even the implied warranty of
15# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16# GNU Affero General Public License for more details.
17#
18# You should have received a copy of the GNU Affero General Public License
19# along with this program. If not, see <http://www.gnu.org/licenses/>.
20#
21##############################################################################
22
23import datetime
24
25from openerp import SUPERUSER_ID
26from openerp import pooler
27from openerp import exceptions
28from openerp.osv.orm import Model
29from openerp.tools.translate import _
30from openerp.tools.safe_eval import safe_eval
31
32
33class res_users(Model):
34 _inherit = "res.users"
35
36 # Private Function section
37 def _get_translation(self, cr, lang, text):
38 context = {'lang': lang}
39 return _(text)
40
41 def _send_email_passkey(self, cr, user_id, user_agent_env):
42 """ Send a email to the admin of the system and / or the user
43 to inform passkey use."""
44 mails = []
45 mail_obj = self.pool['mail.mail']
46 icp_obj = self.pool['ir.config_parameter']
47 admin_user = self.browse(cr, SUPERUSER_ID, SUPERUSER_ID)
48 login_user = self.browse(cr, SUPERUSER_ID, user_id)
49 send_to_admin = safe_eval(icp_obj.get_param(
50 cr, SUPERUSER_ID, 'auth_admin_passkey.send_to_admin', 'True'))
51 send_to_user = safe_eval(icp_obj.get_param(
52 cr, SUPERUSER_ID, 'auth_admin_passkey.send_to_user', 'True'))
53
54 if send_to_admin and admin_user.email:
55 mails.append({'email': admin_user.email, 'lang': admin_user.lang})
56 if send_to_user and login_user.email:
57 mails.append({'email': login_user.email, 'lang': login_user.lang})
58
59 for mail in mails:
60 subject = self._get_translation(
61 cr, mail['lang'], _('Passkey used'))
62 body = self._get_translation(
63 cr, mail['lang'],
64 _("""Admin user used his passkey to login with '%s'.\n\n"""
65 """\n\nTechnicals informations belows : \n\n"""
66 """- Login date : %s\n\n""")) % (
67 login_user.login,
68 datetime.datetime.now().strftime("%Y-%m-%d %H:%M:%S"))
69 for k, v in user_agent_env.iteritems():
70 body += ("- %s : %s\n\n") % (k, v)
71 mail_obj.create(
72 cr, SUPERUSER_ID, {
73 'email_to': mail['email'],
74 'subject': subject,
75 'body_html': '<pre>%s</pre>' % body})
76
77 def _send_email_same_password(self, cr, login_user):
78 """ Send a email to the admin user to inform that another user has the
79 same password as him."""
80 mail_obj = self.pool['mail.mail']
81 admin_user = self.browse(cr, SUPERUSER_ID, SUPERUSER_ID)
82 if admin_user.email:
83 mail_obj.create(cr, SUPERUSER_ID, {
84 'email_to': admin_user.email,
85 'subject': self._get_translation(
86 cr, admin_user.lang, _('[WARNING] OpenERP Security Risk')),
87 'body_html': self._get_translation(
88 cr, admin_user.lang, _(
89 """<pre>User with login '%s' has the same """
90 """password as you.</pre>""")) % (login_user),
91 })
92
93 # Overload Section
94 def authenticate(self, db, login, password, user_agent_env):
95 """ Authenticate the user 'login' is password is ok or if
96 is admin password. In the second case, send mail to user and admin."""
97 user_id = super(res_users, self).authenticate(
98 db, login, password, user_agent_env)
99 if user_id != SUPERUSER_ID:
100 same_password = False
101 cr = pooler.get_db(db).cursor()
102 try:
103 # directly use parent 'check_credentials' function
104 # to really know if credentials are ok
105 # or if it was admin password
106 super(res_users, self).check_credentials(
107 cr, SUPERUSER_ID, password)
108 try:
109 # Test now if the user has the same password as admin user
110 super(res_users, self).check_credentials(
111 cr, user_id, password)
112 same_password = True
113 except exceptions.AccessDenied:
114 pass
115 if not same_password:
116 self._send_email_passkey(cr, user_id, user_agent_env)
117 else:
118 self._send_email_same_password(cr, login)
119 cr.commit()
120 except exceptions.AccessDenied:
121 pass
122 finally:
123 cr.close()
124 return user_id
125
126 def check_credentials(self, cr, uid, password):
127 """ Return now True if credentials are good OR if password is admin
128password."""
129 if uid != SUPERUSER_ID:
130 try:
131 super(res_users, self).check_credentials(
132 cr, uid, password)
133 return True
134 except exceptions.AccessDenied:
135 return self.check_credentials(cr, SUPERUSER_ID, password)
136 else:
137 return super(res_users, self).check_credentials(cr, uid, password)
0138
=== added directory 'auth_admin_passkey/static'
=== added directory 'auth_admin_passkey/static/src'
=== added directory 'auth_admin_passkey/static/src/img'
=== added file 'auth_admin_passkey/static/src/img/icon.png'
1Binary files auth_admin_passkey/static/src/img/icon.png 1970-01-01 00:00:00 +0000 and auth_admin_passkey/static/src/img/icon.png 2014-04-02 16:03:13 +0000 differ139Binary files auth_admin_passkey/static/src/img/icon.png 1970-01-01 00:00:00 +0000 and auth_admin_passkey/static/src/img/icon.png 2014-04-02 16:03:13 +0000 differ
=== added directory 'auth_admin_passkey/view'
=== added file 'auth_admin_passkey/view/res_config_view.xml'
--- auth_admin_passkey/view/res_config_view.xml 1970-01-01 00:00:00 +0000
+++ auth_admin_passkey/view/res_config_view.xml 2014-04-02 16:03:13 +0000
@@ -0,0 +1,47 @@
1<?xml version="1.0" encoding="UTF-8"?>
2<!-- ********************************************************************** -->
3<!--Admin Passkey module for OpenERP -->
4<!--Copyright (C) 2013-2014 GRAP (http://www.grap.coop) -->
5<!--@author Sylvain LE GAL (https://twitter.com/legalsylvain) -->
6
7<!--This program is free software: you can redistribute it and/or modify -->
8<!--it under the terms of the GNU Affero General Public License as -->
9<!--published by the Free Software Foundation, either version 3 of the -->
10<!--License, or (at your option) any later version. -->
11
12<!--This program is distributed in the hope that it will be useful, -->
13<!--but WITHOUT ANY WARRANTY; without even the implied warranty of -->
14<!--MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -->
15<!--GNU Affero General Public License for more details. -->
16
17<!--You should have received a copy of the GNU Affero General Public License-->
18<!--along with this program. If not, see <http://www.gnu.org/licenses/>. -->
19<!-- ********************************************************************** -->
20<openerp>
21 <data>
22
23 <record id="view_res_config_settings" model="ir.ui.view">
24 <field name="name">base.config.settings.view</field>
25 <field name="model">base.config.settings</field>
26 <field name="inherit_id" ref="base_setup.view_general_configuration"/>
27 <field name="arch" type="xml">
28 <xpath expr="//label[@string='Email']/.." position='after'>
29 <group>
30 <label for="id" string="Passkey"/>
31 <div>
32 <div>
33 <field name="auth_admin_passkey_send_to_admin" class="oe_inline"/>
34 <label for="auth_admin_passkey_send_to_admin"/>
35 </div>
36 <div>
37 <field name="auth_admin_passkey_send_to_user" class="oe_inline"/>
38 <label for="auth_admin_passkey_send_to_user"/>
39 </div>
40 </div>
41 </group>
42 </xpath>
43 </field>
44 </record>
45
46 </data>
47</openerp>