tryton-do/tryton
2
0
Fork 0
Code Issues Pull Requests 2 Actions 1 Packages Projects Releases Wiki Activity
6,229 Commits 12 Branches 0 Tags
a9f00a2d40fdd1defbf90d4d2b3cdc1ce4c2d6ac
Commit Graph
51 Commits
Author SHA1 Message Date
Cédric Krier a0bfbfa255 Follow isort formatting 
issue10928
 2021-12-11 17:58:45 +01:00
Cédric Krier 15671394ed Use autocommit transaction to reset session 
This avoids concurrency error if other requests try also to reset the session.

issue9478
review327621002
 2020-07-25 07:59:07 +02:00
Nicolas Évrard 8fb13634ea Use direct access to backend classes 
issue8836
review258421002
 2019-12-06 17:33:47 +01:00
Cédric Krier 011f510dc9 Stop retry to remove session once it succeed 
After the removal the loop must be broken and if no session has been removed
it should log an error message.

issue7852
review74421002
 2018-11-18 12:07:17 +01:00
Cédric Krier 5a7aca31ea Manage session with max_age and timeout 
and clear session when password is changed.

The sessions are checked using on a fix maximum age of 30 days using the
create_date value. The write_date is updated as long as the delay of the last
update is not bigger than the session timeout.
RPC can request a fresh session. A fresh session is a session that was updated
last time before the session timeout. If it is not the case, the session is
deleted and a request to create a new session is sent to the client.
All the sessions of the users for which the password has been changed are also
deleted in order to ensure that stolen session can no more be used.
We use this new feature for set_preferences of user instead of duplicate the
login mechanism.

issue7568
review53331002
 2018-08-26 18:04:05 +02:00
Cédric Krier 1c32a02b64 Simplify API for Session 
- Allow to extend session management with a domain
- Let security manage the logging
- Let check differentiate expired session and session that does not exist

issue7134
review39171002
 2018-03-07 00:34:09 +01:00
Cédric Krier 7388e7b233 Add '_request' attribute to Transaction context 
issue7110
review41031002
 2018-02-14 19:22:03 +01:00
Cédric Krier afdc884277 Return 429 status when too many login attempts 
This prevents to consume too much resource by sleeping over a very long period.

issue6215
review29161002
 2017-02-02 11:55:44 +01:00
Cédric Krier 27387b0960 Manage database retry in login/logout 
A concurrency exception could be raised if two successful login/logout are
requested simultaneously.

issue5890
review32591002
 2016-09-22 11:31:18 +02:00
Sergi Almacellas Abellana 5967d21d46 Remove database management from RPC 
issue5384
review29311002
 2016-07-07 16:05:45 +02:00
Cédric Krier 2c390fe71a Add customizable login process 
It adds new configuration option to define the list of login methods.
It defines a new Exception to use to request user data during the login
process.
It separates the generic login attempt protection from the actual
authentication method.
It replace the API of the login methods to use a dictionary of parameters
instead of a single password.

issue5521
review16191003
 2016-05-31 12:49:23 +02:00
Cédric Krier 8a4ba59b2d Switch to WSGI API 
issue4646
review20541003
 2016-03-15 16:57:26 +01:00
Nicolas Évrard 2fef479575 Follow PEP-0249 for Transaction and backends 
issue4949
review19781002
 2016-03-03 21:51:57 +01:00
Cédric Krier c144f8c349 Fix most flake8 errors 
review8771002
 2014-12-02 12:54:01 +01:00
Cédric Krier e0b995abbe Refactore configuration to allow easy extention 
issue3627
review7401002
 2014-09-03 23:32:01 +02:00
Vishesh Yadav 29a2f28d8f Check if session exist when logging out. 
issue3344
review1040002
 2013-09-05 01:59:22 +05:30
Albert Cervera i Areny 30b1403cdc Use a list of dictionaries in create(). 
issue2358
review266002
 2013-01-06 22:18:13 +01:00
Nicolas Évrard 6c956d1555 fix use of password not in ASCII 
review582004
issue2869
 2012-11-13 11:26:38 +01:00
Cédric Krier 0fe1b93864 Active Record 2012-09-24 22:16:53 +02:00
Cédric Krier 90f33676c0 Factorize pool initialization 2012-03-16 12:11:05 +01:00
Cédric Krier 415005af60 Intialize the Pool also for password check and logout if needed 2012-02-28 13:14:26 +01:00
Cédric Krier 7d457f46c4 Store session in database 
review210012
 2012-01-11 20:30:27 +01:00
Nicolas Évrard 0a471486e0 correct pyflake errors 
review164003
 2011-11-02 15:49:38 +01:00
Cédric Krier 1a84c04adf Rational exceptions 
review94001
 2011-09-05 20:30:26 +02:00
Cédric Krier 852f04dc51 Remove support of Python2.5 and fix py3 warnings 2011-07-12 00:16:15 +02:00
Cédric Krier df1fd283ac New transaction management 
Remove cursor, user and context from methods and use Transaction instead
 2010-08-19 22:01:12 +02:00
Cédric Krier b5fb4d1ef3 Refactoring by validation with pylint 2010-02-18 18:50:35 +01:00
Cédric Krier 69b14b9b70 Allow to have accent in password 2009-09-23 18:42:27 +02:00
Cédric Krier fb007b7733 Add commit for login cursor. 
It will allow to make some database processing during login.
 2009-09-10 16:39:39 +02:00
Cédric Krier 77a0c1df80 Move login test in res.user 2009-08-25 19:15:50 +02:00
Cédric Krier 2f04fe8645 Add logout method 2009-08-14 11:38:02 +02:00
Cédric Krier 25febb7cbb Reset session timeout at the end of the call 2009-08-05 11:30:56 +02:00
Cédric Krier ab45d85e78 Add salt to sha of password 2009-07-29 16:27:18 +02:00
Cédric Krier a359c7c0a2 Fix the use of rowcount because it can return -1 or None according to PEP249 2009-07-07 19:14:51 +02:00
Cédric Krier 1a10e5ffaa Fix warnings for python 2.6 for issue915 2009-04-08 17:55:24 +02:00
Cédric Krier b75d10cd20 Use a new pool for object 
Move workflow method in ModelWorkflow
Move workflow service in workflow module
Remove Service and LocalService
Remove web_service and use a dispatcher in protocols
New netrpc/xmlrpc syntax to be easier to introspect
 2009-02-11 14:52:22 +01:00
Cédric Krier 7b87d07dc8 Add exponential timeout on failed login attempts. 
Thanks to Bruce's comment about the Twitter issue.
 2009-01-13 13:16:51 +01:00
Cédric Krier 716f60afe9 Use a Session object for user instead of just an integer 2008-12-11 17:05:52 +01:00
Cédric Krier 7fab1ade14 Prevent root login from webservices 2008-10-20 10:16:18 +02:00
Mathias Behrle edc4d80f83 Make session timeout configurable 2008-09-05 22:28:28 +02:00
Cédric Krier 1d0a672580 Fix cleaning session timeout 2008-07-26 17:09:34 +02:00
Cédric Krier b1a9433904 Remove encode stuff as we use unicode everywhere 2008-07-24 12:54:12 +02:00
Cédric Krier 21efdb4456 Improve security check from remarks of Hartmut Goebel 2008-07-18 15:11:58 +02:00
Cédric Krier 3a363eaea5 Allow to have more than one session per users. 2008-06-26 11:00:29 +02:00
Cédric Krier 0232c66506 Fix COPYRIGHT 2008-06-23 20:18:54 +02:00
Cédric Krier 0d7a17c849 Fix login for webdav 2008-03-11 17:14:52 +01:00
Cédric Krier 60be3c14f9 Add session and timeout 2008-03-05 15:10:21 +01:00
Cédric Krier 43a3cac11e Add SHA encryption for password 2008-03-02 02:31:44 +01:00
Cédric Krier a013c3bdca Change all query with %d into %s for psycopg2 2008-02-27 11:10:51 +01:00
Bertrand Chenal 2648bd1ead Removed plurals on user, role and group 2007-12-17 23:34:43 +01:00