Fork Sync Branch 19.0

README.md

@@ -28,6 +28,8 @@ addon | version | maintainers | summary
 [auth_session_timeout](auth_session_timeout/) | 19.0.1.0.0 |  | This module disable all inactive sessions since a given delay
 [auth_user_case_insensitive](auth_user_case_insensitive/) | 19.0.1.0.0 |  | Makes the user login field case insensitive
 [impersonate_login](impersonate_login/) | 19.0.1.0.1 | <a href='https://github.com/Kev-Roche'><img src='https://github.com/Kev-Roche.png' width='32' height='32' style='border-radius:50%;' alt='Kev-Roche'/></a> | tools
+[password_security](password_security/) | 19.0.1.0.0 |  | Allow admin to set password security requirements.
+[user_log_view](user_log_view/) | 19.0.1.0.0 | <a href='https://github.com/trojikman'><img src='https://github.com/trojikman.png' width='32' height='32' style='border-radius:50%;' alt='trojikman'/></a> | Allow to see user's actions log
 
 [//]: # (end addons)
 

auth_api_key/tests/test_controllers.py

@@ -17,7 +17,9 @@ def setUpClass(cls):
             cls.env,
             name="Test User",
             login="test",
-            password="test",
+            # Strong enough for password_security, which lands in the same
+            # database on the CI and enforces its policy on every user.
+            password="Test!2345",
             email="test@test.com",
             group_ids=[cls.env.ref("base.group_user").id],
             company_id=cls.env.company.id,

impersonate_login/static/src/js/user_menu.esm.js

@@ -2,9 +2,9 @@
 // License AGPL-3.0 or later (http://www.gnu.org/licenses/agpl).
 
 import {_t} from "@web/core/l10n/translation";
+import {markup} from "@odoo/owl";
 import {registry} from "@web/core/registry";
 import {session} from "@web/session";
-import {markup} from "@odoo/owl";
 
 export function impersonateLoginItem(env) {
     return {

impersonate_login/tests/test_impersonate_login.py

@@ -15,7 +15,9 @@ class TestImpersonateLogin(HttpCase):
     def setUpClass(cls):
         super().setUpClass()
         cls.demo_login = "impersonate_demo"
-        cls.demo_password = "demo"
+        # Strong enough for password_security, which lands in the same
+        # database on the CI and enforces its policy on every user.
+        cls.demo_password = "Demo!2345"
         # Admin always exists; ensure it can impersonate and has a known password
         cls.admin_user = cls.env.ref("base.user_admin")
         # Make sure admin can use the feature (group check in session info)

password_security/README.rst

@@ -0,0 +1,139 @@
+.. image:: https://odoo-community.org/readme-banner-image
+   :target: https://odoo-community.org/get-involved?utm_source=readme
+   :alt: Odoo Community Association
+
+=================
+Password Security
+=================
+
+.. 
+   !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+   !! This file is generated by oca-gen-addon-readme !!
+   !! changes will be overwritten.                   !!
+   !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+   !! source digest: sha256:08e5a49da633f1b1636ce4877debefb01bb6adda8d4f42ba59bf6b0f58c4cc63
+   !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+
+.. |badge1| image:: https://img.shields.io/badge/maturity-Beta-yellow.png
+    :target: https://odoo-community.org/page/development-status
+    :alt: Beta
+.. |badge2| image:: https://img.shields.io/badge/license-LGPL--3-blue.png
+    :target: http://www.gnu.org/licenses/lgpl-3.0-standalone.html
+    :alt: License: LGPL-3
+.. |badge3| image:: https://img.shields.io/badge/github-OCA%2Fserver--auth-lightgray.png?logo=github
+    :target: https://github.com/OCA/server-auth/tree/19.0/password_security
+    :alt: OCA/server-auth
+.. |badge4| image:: https://img.shields.io/badge/weblate-Translate%20me-F47D42.png
+    :target: https://translation.odoo-community.org/projects/server-auth-19-0/server-auth-19-0-password_security
+    :alt: Translate me on Weblate
+.. |badge5| image:: https://img.shields.io/badge/runboat-Try%20me-875A7B.png
+    :target: https://runboat.odoo-community.org/builds?repo=OCA/server-auth&target_branch=19.0
+    :alt: Try me on Runboat
+
+|badge1| |badge2| |badge3| |badge4| |badge5|
+
+This module allows admin to set company-level password security
+requirements and enforces them on the user.
+
+It contains features such as
+
+- Password expiration days
+- Password length requirement
+- Password minimum number of lowercase letters
+- Password minimum number of uppercase letters
+- Password minimum number of numbers
+- Password minimum number of special characters
+
+**Table of contents**
+
+.. contents::
+   :local:
+
+Configuration
+=============
+
+Navigate to General Settings under Configuration Scroll down to the
+``Password Policy`` section Set the policies to your liking.
+
+Password complexity requirements will be enforced upon next password
+change for any user in that company.
+
+**Settings & Defaults**
+
+These are defined at the company level:
+
+[TABLE]
+
+Usage
+=====
+
+Configure using above instructions for each company that should have
+password security mandates.
+
+Bug Tracker
+===========
+
+Bugs are tracked on `GitHub Issues <https://github.com/OCA/server-auth/issues>`_.
+In case of trouble, please check there if your issue has already been reported.
+If you spotted it first, help us to smash it by providing a detailed and welcomed
+`feedback <https://github.com/OCA/server-auth/issues/new?body=module:%20password_security%0Aversion:%2019.0%0A%0A**Steps%20to%20reproduce**%0A-%20...%0A%0A**Current%20behavior**%0A%0A**Expected%20behavior**>`_.
+
+Do not contact contributors directly about support or help with technical issues.
+
+Credits
+=======
+
+Authors
+-------
+
+* LasLabs
+* Onestein
+* Kaushal Prajapati
+* Tecnativa
+* initOS GmbH
+* Omar Nasr
+
+Contributors
+------------
+
+- James Foster <jfoster@laslabs.com>
+
+- Dave Lasley <dave@laslabs.com>
+
+- Kaushal Prajapati <kbprajapati@live.com>
+
+- Petar Najman <petar.najman@modoolar.com>
+
+- Shepilov Vladislav <shepilov.v@protonmail.com>
+
+- Florian Kantelberg <florian.kantelberg@initos.com>
+
+- Carlos Jimeno <carlos.jimeno@bt-group.com>
+
+- Dhara Solanki <dhara.solanki@initos.com>
+
+- `Open Source Integrators <https://opensourceintegrators.com>`__
+
+     - Chandresh Thakkar <cthakkar@opensourceintegrators.com>
+     - Daniel Reis <dreis@opensourceintegrators.com>
+
+- `Onestein <https://www.onestein.nl>`__:
+
+  - Andrea Stirpe <a.stirpe@onestein.nl>
+
+Maintainers
+-----------
+
+This module is maintained by the OCA.
+
+.. image:: https://odoo-community.org/logo.png
+   :alt: Odoo Community Association
+   :target: https://odoo-community.org
+
+OCA, or the Odoo Community Association, is a nonprofit organization whose
+mission is to support the collaborative development of Odoo features and
+promote its widespread use.
+
+This module is part of the `OCA/server-auth <https://github.com/OCA/server-auth/tree/19.0/password_security>`_ project on GitHub.
+
+You are welcome to contribute. To learn how please visit https://odoo-community.org/page/Contribute.

password_security/__init__.py

@@ -0,0 +1,5 @@
+# Copyright 2015 LasLabs Inc.
+# License LGPL-3.0 or later (http://www.gnu.org/licenses/lgpl.html).
+
+from .post_install import init_config_parameters
+from . import controllers, models

password_security/__manifest__.py

@@ -0,0 +1,34 @@
+# Copyright 2015 LasLabs Inc.
+# Copyright 2018 Modoolar <info@modoolar.com>.
+# Copyright 2019 initOS GmbH
+# License LGPL-3.0 or later (http://www.gnu.org/licenses/lgpl.html).
+{
+    "name": "Password Security",
+    "summary": "Allow admin to set password security requirements.",
+    "version": "19.0.1.0.0",
+    "author": "LasLabs, "
+    "Onestein, "
+    "Kaushal Prajapati, "
+    "Tecnativa, "
+    "initOS GmbH, "
+    "Omar Nasr, "
+    "Odoo Community Association (OCA)",
+    "category": "Base",
+    "depends": [
+        "auth_signup",
+        "auth_password_policy_signup",
+        "auth_totp",
+    ],
+    "website": "https://github.com/OCA/server-auth",
+    "license": "LGPL-3",
+    "data": [
+        "views/res_config_settings_views.xml",
+        "security/ir.model.access.csv",
+        "security/res_users_pass_history.xml",
+    ],
+    "demo": [
+        "demo/res_users.xml",
+    ],
+    "post_init_hook": "init_config_parameters",
+    "installable": True,
+}

password_security/controllers/__init__.py

@@ -0,0 +1,5 @@
+# Copyright 2015 LasLabs Inc.
+# License LGPL-3.0 or later (http://www.gnu.org/licenses/lgpl.html).
+
+from . import main
+from . import home

password_security/controllers/home.py

@@ -0,0 +1,28 @@
+# Copyright 2022 brain-tec AG (https://bt-group.com)
+# License LGPL-3.0 or later (https://www.gnu.org/licenses/lgpl.html).
+
+from odoo import http
+from odoo.http import request
+
+from odoo.addons.auth_totp.controllers.home import Home
+
+
+class PasswordSecurity2FAHome(Home):
+    @http.route()
+    def web_totp(self, redirect=None, **kwargs):
+        already_logged_in = request.session.uid
+        result = super().web_totp(redirect, **kwargs)
+        if already_logged_in or not (
+            request.session.uid and request.env.user._password_has_expired()
+        ):
+            return result
+        # My password is expired, kick me out
+        request.env.user.action_expire_password()
+        request.session.logout(keep_db=True)
+        # res.users._login() loaded login_date into this env's cache before
+        # _update_last_login() created the new res.users.log, so the cached
+        # value is stale. _generate_signup_token() signs login_date into the
+        # token, and a stale one is rejected as an invalid signup token.
+        request.env.user.invalidate_recordset(["login_date", "log_ids"])
+        redirect = request.env.user.partner_id._get_signup_url()
+        return request.redirect(redirect)

password_security/controllers/main.py

@@ -0,0 +1,65 @@
+# Copyright 2015 LasLabs Inc.
+# License LGPL-3.0 or later (http://www.gnu.org/licenses/lgpl.html).
+
+
+from werkzeug.exceptions import BadRequest
+
+from odoo import http
+from odoo.http import request
+
+from odoo.addons.auth_signup.controllers.main import AuthSignupHome
+from odoo.addons.web.controllers.home import ensure_db
+
+
+class PasswordSecurityHome(AuthSignupHome):
+    def do_signup(self, qcontext, *args, **kwargs):
+        password = qcontext.get("password")
+        user = request.env.user
+        user._check_password(password)
+        return super().do_signup(qcontext, *args, **kwargs)
+
+    @http.route()
+    def web_login(self, *args, **kw):
+        ensure_db()
+        response = super().web_login(*args, **kw)
+        if not request.params.get("login_success"):
+            return response
+        if not request.env.user:
+            return response
+        # Now, I'm an authenticated user
+        # With 2FA there is a second step, and we would not be completely logged in
+        if not (request.session.uid and request.env.user._password_has_expired()):
+            return response
+        # My password is expired, kick me out
+        request.env.user.action_expire_password()
+        request.session.logout(keep_db=True)
+        # I was kicked out, so set login_success in request params to False
+        request.params["login_success"] = False
+        # res.users._login() loaded login_date into this env's cache before
+        # _update_last_login() created the new res.users.log, so the cached
+        # value is stale. _generate_signup_token() signs login_date into the
+        # token, and a stale one is rejected as an invalid signup token.
+        request.env.user.invalidate_recordset(["login_date", "log_ids"])
+        redirect = request.env.user.partner_id._get_signup_url()
+        return request.redirect(redirect)
+
+    @http.route()
+    def web_auth_signup(self, *args, **kw):
+        """Try to catch all the possible exceptions not already handled
+        in the parent method"""
+
+        try:
+            qcontext = self.get_auth_signup_qcontext()
+        except Exception:
+            raise BadRequest from None  # HTTPError: 400 Client Error: BAD REQUEST
+
+        try:
+            return super().web_auth_signup(*args, **kw)
+        except Exception as e:
+            # Here we catch any generic exception since UserError is already
+            # handled in parent method web_auth_signup()
+            qcontext["error"] = str(e)
+            response = request.render("auth_signup.signup", qcontext)
+            response.headers["X-Frame-Options"] = "SAMEORIGIN"
+            response.headers["Content-Security-Policy"] = "frame-ancestors 'self'"
+            return response

password_security/demo/res_users.xml

@@ -0,0 +1,9 @@
+<!--
+    Copyright 2016 LasLabs Inc.
+    License LGPL-3.0 or later (http://www.gnu.org/licenses/lgpl.html).
+-->
+<odoo>
+    <record id="base.user_root" model="res.users">
+        <field name="password_write_date" eval="datetime.now()" />
+    </record>
+</odoo>