From 7fab1ade148ffa8af4bee0e16ed154336e5d87a6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Krier?= <ced@b2ck.com>
Date: Mon, 20 Oct 2008 10:16:18 +0200
Subject: [PATCH] Prevent root login from webservices

---
 trytond/security.py | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/trytond/security.py b/trytond/security.py
index 6f6ea4a55a..aec7829afd 100644
--- a/trytond/security.py
+++ b/trytond/security.py
@@ -17,6 +17,8 @@ def login(dbname, loginname, password, cache=True):
     cursor.close()
     if res:
         user_id = res[0]
+        if user_id == 0:
+            return False
         if cache:
             _USER_CACHE.setdefault(dbname, {})
             timestamp = time.time()
@@ -36,6 +38,8 @@ def check_super(passwd):
         raise Exception('AccessDenied')
 
 def check(dbname, user, session, outdate_timeout=True):
+    if user == 0:
+        raise Exception('AccessDenied')
     result = False
     if _USER_CACHE.get(dbname, {}).has_key(user):
         to_del = []
@@ -53,4 +57,4 @@ def check(dbname, user, session, outdate_timeout=True):
             del _USER_CACHE[dbname][user][i]
     if result:
         return True
-    raise Exception('NotLogged')
\ No newline at end of file
+    raise Exception('NotLogged')