Cédric Krier
5a7aca31ea
and clear session when password is changed. The sessions are checked using on a fix maximum age of 30 days using the create_date value. The write_date is updated as long as the delay of the last update is not bigger than the session timeout. RPC can request a fresh session. A fresh session is a session that was updated last time before the session timeout. If it is not the case, the session is deleted and a request to create a new session is sent to the client. All the sessions of the users for which the password has been changed are also deleted in order to ensure that stolen session can no more be used. We use this new feature for set_preferences of user instead of duplicate the login mechanism. issue7568 review53331002
135 lines
4.8 KiB
Python
135 lines
4.8 KiB
Python
# This file is part of Tryton. The COPYRIGHT file at the top level of
|
|
# this repository contains the full copyright notices and license terms.
|
|
import logging
|
|
|
|
from trytond.pool import Pool
|
|
from trytond.config import config
|
|
from trytond.transaction import Transaction
|
|
from trytond import backend
|
|
from trytond.exceptions import LoginException, RateLimitException
|
|
|
|
logger = logging.getLogger(__name__)
|
|
|
|
|
|
def _get_pool(dbname):
|
|
database_list = Pool.database_list()
|
|
pool = Pool(dbname)
|
|
if dbname not in database_list:
|
|
pool.init()
|
|
return pool
|
|
|
|
|
|
def _get_remote_addr(context):
|
|
if context and '_request' in context:
|
|
return context['_request'].get('remote_addr')
|
|
|
|
|
|
def login(dbname, loginname, parameters, cache=True, context=None):
|
|
DatabaseOperationalError = backend.get('DatabaseOperationalError')
|
|
for count in range(config.getint('database', 'retry'), -1, -1):
|
|
with Transaction().start(dbname, 0, context=context) as transaction:
|
|
pool = _get_pool(dbname)
|
|
User = pool.get('res.user')
|
|
try:
|
|
user_id = User.get_login(loginname, parameters)
|
|
except DatabaseOperationalError:
|
|
if count:
|
|
continue
|
|
raise
|
|
except (LoginException, RateLimitException):
|
|
# Let's store any changes done
|
|
transaction.commit()
|
|
raise
|
|
break
|
|
session = None
|
|
if user_id:
|
|
if not cache:
|
|
session = user_id
|
|
else:
|
|
with Transaction().start(dbname, user_id):
|
|
Session = pool.get('ir.session')
|
|
session = user_id, Session.new()
|
|
logger.info("login succeeded for '%s' from '%s' on database '%s'",
|
|
loginname, _get_remote_addr(context), dbname)
|
|
else:
|
|
logger.error("login failed for '%s' from '%s' on database '%s'",
|
|
loginname, _get_remote_addr(context), dbname)
|
|
return session
|
|
|
|
|
|
def logout(dbname, user, session, context=None):
|
|
DatabaseOperationalError = backend.get('DatabaseOperationalError')
|
|
for count in range(config.getint('database', 'retry'), -1, -1):
|
|
with Transaction().start(dbname, 0, context=context):
|
|
pool = _get_pool(dbname)
|
|
Session = pool.get('ir.session')
|
|
try:
|
|
name = Session.remove(session)
|
|
except DatabaseOperationalError:
|
|
if count:
|
|
continue
|
|
raise
|
|
logger.info("logout for '%s' from '%s' on database '%s'",
|
|
name, _get_remote_addr(context), dbname)
|
|
|
|
|
|
def check(dbname, user, session, context=None):
|
|
DatabaseOperationalError = backend.get('DatabaseOperationalError')
|
|
for count in range(config.getint('database', 'retry'), -1, -1):
|
|
with Transaction().start(dbname, user, context=context) as transaction:
|
|
pool = _get_pool(dbname)
|
|
Session = pool.get('ir.session')
|
|
try:
|
|
find = Session.check(user, session)
|
|
break
|
|
except DatabaseOperationalError:
|
|
if count:
|
|
continue
|
|
raise
|
|
finally:
|
|
transaction.commit()
|
|
if find is None:
|
|
logger.error("session failed for '%s' from '%s' on database '%s'",
|
|
user, _get_remote_addr(context), dbname)
|
|
return
|
|
elif not find:
|
|
logger.info("session expired for '%s' from '%s' on database '%s'",
|
|
user, _get_remote_addr(context), dbname)
|
|
return
|
|
else:
|
|
logger.debug("session valid for '%s' from '%s' on database '%s'",
|
|
user, _get_remote_addr(context), dbname)
|
|
return user
|
|
|
|
|
|
def check_timeout(dbname, user, session, context=None):
|
|
DatabaseOperationalError = backend.get('DatabaseOperationalError')
|
|
for count in range(config.getint('database', 'retry'), -1, -1):
|
|
with Transaction().start(dbname, user, context=context) as transaction:
|
|
pool = _get_pool(dbname)
|
|
Session = pool.get('ir.session')
|
|
try:
|
|
valid = Session.check_timeout(user, session)
|
|
break
|
|
except DatabaseOperationalError:
|
|
if count:
|
|
continue
|
|
raise
|
|
finally:
|
|
transaction.commit()
|
|
if not valid:
|
|
logger.info("session timeout for '%s' from '%s' on database '%s'",
|
|
user, _get_remote_addr(context), dbname)
|
|
return valid
|
|
|
|
|
|
def reset(dbname, session, context):
|
|
DatabaseOperationalError = backend.get('DatabaseOperationalError')
|
|
try:
|
|
with Transaction().start(dbname, 0, context=context):
|
|
pool = _get_pool(dbname)
|
|
Session = pool.get('ir.session')
|
|
Session.reset(session)
|
|
except DatabaseOperationalError:
|
|
logger.debug('Reset session failed', exc_info=True)
|