From bc8def47b07030042462947c91d3f1bc2cbf92f3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Krier?= <ced@b2ck.com>
Date: Wed, 2 Sep 2026 12:19:42 +0200
Subject: [PATCH] Enforce the type of login parameters

As they are received from a non authenticated entrypoint, we must ensure their
types.
---
 modules/authentication_sms/res.py  |  2 +-
 modules/ldap_authentication/res.py |  2 +-
 trytond/trytond/res/user.py        | 33 +++++++++++++++---------------
 3 files changed, 19 insertions(+), 18 deletions(-)

diff --git a/modules/authentication_sms/res.py b/modules/authentication_sms/res.py
index c0e5882f01..a5bda934f6 100644
--- a/modules/authentication_sms/res.py
+++ b/modules/authentication_sms/res.py
@@ -40,7 +40,7 @@ class User(metaclass=PoolMeta):
         if user_id:
             SMSCode.send(user_id)
         if 'sms_code' in parameters:
-            code = parameters['sms_code']
+            code = str(parameters['sms_code'])
             if not code:
                 return
             if SMSCode.check(user_id, code):
diff --git a/modules/ldap_authentication/res.py b/modules/ldap_authentication/res.py
index 3319780522..3d438a397f 100644
--- a/modules/ldap_authentication/res.py
+++ b/modules/ldap_authentication/res.py
@@ -135,7 +135,7 @@ class User(metaclass=PoolMeta):
         if 'password' not in parameters:
             msg = gettext('res.msg_user_password', login=login)
             raise LoginException('password', msg, type='password')
-        password = parameters['password']
+        password = str(parameters['password'])
         try:
             server = ldap_server()
             if server:
diff --git a/trytond/trytond/res/user.py b/trytond/trytond/res/user.py
index f1f5a2293c..9954e908b8 100644
--- a/trytond/trytond/res/user.py
+++ b/trytond/trytond/res/user.py
@@ -775,21 +775,22 @@ class User(avatar_mixin(100, 'login'), DeactivableMixin, ModelSQL, ModelView):
             msg = gettext('res.msg_user_password', login=login)
             raise LoginException('password', msg, type='password')
         user_id, password_hash, password_reset = cls._get_login(login)
-        if user_id and password_hash:
-            password = parameters['password']
-            valid, new_hash = cls.check_password(password, password_hash)
-            if valid:
-                if new_hash:
-                    logger.info("Update password hash for %s", user_id)
-                    with Transaction().new_transaction():
-                        with without_check_access():
-                            cls.write([cls(user_id)], {
-                                    'password_hash': new_hash,
-                                    })
-                return user_id
-        if user_id and password_reset:
-            if compare_digest(password_reset, parameters['password']):
-                return user_id
+        if user_id:
+            password = str(parameters['password'])
+            if password_hash:
+                valid, new_hash = cls.check_password(password, password_hash)
+                if valid:
+                    if new_hash:
+                        logger.info("Update password hash for %s", user_id)
+                        with Transaction().new_transaction():
+                            with without_check_access():
+                                cls.write([cls(user_id)], {
+                                        'password_hash': new_hash,
+                                        })
+                    return user_id
+            if password_reset:
+                if compare_digest(password_reset, password):
+                    return user_id
 
     @classmethod
     def hash_password(cls, password):
@@ -894,7 +895,7 @@ class UserDevice(ModelSQL):
         try:
             device, = cls.search([
                     ('login', '=', login),
-                    ('cookie', '=', cookie),
+                    ('cookie', '=', str(cookie)),
                     ], limit=1)
         except ValueError:
             return None