Daily updates from Odoo
Thursday, July 26, 2018
1 change
Security fixes and vulnerability patches
The system now temporarily blocks repeated failed login attempts after a set number of failures. This helps protect user accounts and the platform from password-guessing attacks while keeping the rule simple and configurable.
Original PR description
Straightforward non-continuous rule, though made overridable. * Exponential backoff seems overly complex for what we want, and maybe penalising for real users who got subjected to an attack. * Should a separate error message be provided? Currently the user will get the hard-coded login failure message (wrong user/password) during the cooldown period. Task 31122 section 4.