Saturday, March 21, 2020
1 change · master
Miscellaneous changes
This commit: - make handle_visibility a private function (even if not exploitable in rpc easily since it uses request.website) - hash the password in db (even if not critic, since this password could be shared on twitter, ... it doesn't cost anything to secure it a bit more) - remove useless sudo, since handle_visibility does a sudo itself. - uses consteq to avoid time attack reporting In the future, this notion of visibility should be handled on controller layer,
Original PR description
This commit:
- make handle_visibility a private function (even if not exploitable in rpc
easily since it uses request.website)
- hash the password in db (even if not critic, since this password could be
shared on twitter, ... it doesn't cost anything to secure it a bit more)
- remove useless sudo, since handle_visibility does a sudo itself.
- uses consteq to avoid time attack reporting
In the future, this notion of visibility should be handled on controller layer,
and no more on the View layer (during rendering)
Description of the issue/feature this PR addresses:
Current behavior before PR:
Desired behavior after PR is merged:
--
I confirm I have signed the CLA and read the PR guidelines at www.odoo.com/submit-pr
Forward-Port-Of: odoo/odoo#46624