diff --git a/auth_password_pwned/README.rst b/auth_password_pwned/README.rst new file mode 100644 index 0000000000..75910f9ded --- /dev/null +++ b/auth_password_pwned/README.rst @@ -0,0 +1,100 @@ +==================== +Password Pwned Check +==================== + +.. + !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! + !! This file is generated by oca-gen-addon-readme !! + !! changes will be overwritten. !! + !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! + !! source digest: sha256:8ef5c3ff5b64085cdfcd667aed1caed570703d9eb90128e264c47f6967a2de9d + !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! + +.. |badge1| image:: https://img.shields.io/badge/maturity-Beta-yellow.png + :target: https://odoo-community.org/page/development-status + :alt: Beta +.. |badge2| image:: https://img.shields.io/badge/licence-AGPL--3-blue.png + :target: http://www.gnu.org/licenses/agpl-3.0-standalone.html + :alt: License: AGPL-3 +.. |badge3| image:: https://img.shields.io/badge/github-OCA%2Fserver--auth-lightgray.png?logo=github + :target: https://github.com/OCA/server-auth/tree/15.0/auth_password_pwned + :alt: OCA/server-auth +.. |badge4| image:: https://img.shields.io/badge/weblate-Translate%20me-F47D42.png + :target: https://translation.odoo-community.org/projects/server-auth-15-0/server-auth-15-0-auth_password_pwned + :alt: Translate me on Weblate +.. |badge5| image:: https://img.shields.io/badge/runboat-Try%20me-875A7B.png + :target: https://runboat.odoo-community.org/builds?repo=OCA/server-auth&target_branch=15.0 + :alt: Try me on Runboat + +|badge1| |badge2| |badge3| |badge4| |badge5| + +This module enforces passwords to be changed once the have appeared in a data breach. + +It uses https://haveibeenpwned.com/API/v3#SearchingPwnedPasswordsByRange to check if the password has appeared in any +data breaches. A great resource provided by Troy Hunt https://haveibeenpwned.com/About . + +**Table of contents** + +.. contents:: + :local: + +Configuration +============= + +ir.config_parameter options +~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +The following config parameters change the behaviour of this addon. + +``auth_password_pwned.range_url`` *string* (Default: https://api.pwnedpasswords.com/range/) + + Change the url the plugins checks hashes against. Needs to behave like described in + https://haveibeenpwned.com/API/v3#SearchingPwnedPasswordsByRange . This is intended to be used for a company mirror + of the API. + +Usage +===== + +Install the plugin to force the users to change their password once it is considered to be publicly known. + +Bug Tracker +=========== + +Bugs are tracked on `GitHub Issues `_. +In case of trouble, please check there if your issue has already been reported. +If you spotted it first, help us to smash it by providing a detailed and welcomed +`feedback `_. + +Do not contact contributors directly about support or help with technical issues. + +Credits +======= + +Authors +~~~~~~~ + +* WT-IO-IT GmbH + +Contributors +~~~~~~~~~~~~ + + +* `WT-IO-IT GmbH `_: + * Andreas Perhab + +Maintainers +~~~~~~~~~~~ + +This module is maintained by the OCA. + +.. image:: https://odoo-community.org/logo.png + :alt: Odoo Community Association + :target: https://odoo-community.org + +OCA, or the Odoo Community Association, is a nonprofit organization whose +mission is to support the collaborative development of Odoo features and +promote its widespread use. + +This module is part of the `OCA/server-auth `_ project on GitHub. + +You are welcome to contribute. To learn how please visit https://odoo-community.org/page/Contribute. diff --git a/auth_password_pwned/__init__.py b/auth_password_pwned/__init__.py new file mode 100644 index 0000000000..91c5580fed --- /dev/null +++ b/auth_password_pwned/__init__.py @@ -0,0 +1,2 @@ +from . import controllers +from . import models diff --git a/auth_password_pwned/__manifest__.py b/auth_password_pwned/__manifest__.py new file mode 100644 index 0000000000..8df8271218 --- /dev/null +++ b/auth_password_pwned/__manifest__.py @@ -0,0 +1,20 @@ +# License AGPL-3.0 or later (http://www.gnu.org/licenses/agpl.html). +{ + "name": "Password Pwned Check", + "summary": "Prevent using pwned passwords.", + "version": "15.0.1.0.0", + "author": "WT-IO-IT GmbH, Odoo Community Association (OCA)", + "category": "Base", + "depends": [], + "website": "https://github.com/OCA/server-auth", + "external_dependencies": {}, + "license": "AGPL-3", + "data": [], + "assets": { + 'web.assets_tests': [ + 'auth_password_pwned/static/tests/tours/**/*', + ], + }, + "demo": [], + "installable": True, +} diff --git a/auth_password_pwned/controllers/__init__.py b/auth_password_pwned/controllers/__init__.py new file mode 100644 index 0000000000..e07a9f0cbc --- /dev/null +++ b/auth_password_pwned/controllers/__init__.py @@ -0,0 +1,3 @@ +from . import main +# TODO only in tests +from . import test_controllers diff --git a/auth_password_pwned/controllers/main.py b/auth_password_pwned/controllers/main.py new file mode 100644 index 0000000000..727f3ecebe --- /dev/null +++ b/auth_password_pwned/controllers/main.py @@ -0,0 +1,85 @@ +# License AGPL-3.0 or later (http://www.gnu.org/licenses/agpl.html). + +import logging + +from odoo import _, http +from odoo.http import request + +from odoo.addons.web.controllers.main import Home + +_logger = logging.getLogger(__name__) + + +class AuthPasswordPwnedHome(Home): + def _auth_signup_is_installed(self): + return bool( + request.env["ir.module.module"] + .sudo() + .search( + [("name", "=", "auth_signup"), ("state", "in", ["installed"])], limit=1 + ) + ) + + def _reset_password_enabled(self): + return ( + request.env["ir.config_parameter"] + .sudo() + .get_param("auth_signup.reset_password") + == "True" + ) + + @http.route() + def web_login(self, *args, **kw): + pwned = False + reset_pw_after_validation = False + if "password" in kw and request.env.user._passwordhasbeenpwned(kw["password"]): + if self._auth_signup_is_installed(): + if self._reset_password_enabled(): + # prevent login with a pwned password and force user to reset it + kw["password"] = "" + request.params["password"] = "" + pwned = _( + "This password is known by third parties please reset it and" + " use a different password." + ) + else: + # prepare to hint the user to their email + # reset the password after it has been validated + reset_pw_after_validation = True + pwned = _( + "This password is known by third parties an email has been" + " sent with instructions how to reset it." + ) + + else: + # display a login message and tell the user they should contact the admin + # to start a safe password change procedure + kw["password"] = "" + request.params["password"] = "" + pwned = _( + "This password is known by third parties please contact an" + " administrator how to get a new one." + ) + response = super().web_login(*args, **kw) + if reset_pw_after_validation and request.params.get("login_success"): + # do not allow user to continue and send them a reset password email + request.params["login_success"] = False + request.session.logout(keep_db=True) + try: + request.env["res.users"].sudo().reset_password(kw["login"]) + except Exception as e: + # Log the exception and continue to tell the "user" an email has been sent. + # reset_password only throws an exception if the login is not correct + # / not active so this is most likely someone guessing usernames. + _logger.error( + _("Could not reset password for {login}: {exception}").format( + login=kw["login"], exception=e + ) + ) + # make the response render the login with our error message + kw["password"] = "" + request.params["password"] = "" + response = super().web_login(*args, **kw) + if pwned: + response.qcontext["error"] = pwned + return response diff --git a/auth_password_pwned/controllers/test_controllers.py b/auth_password_pwned/controllers/test_controllers.py new file mode 100644 index 0000000000..90f37e6eaa --- /dev/null +++ b/auth_password_pwned/controllers/test_controllers.py @@ -0,0 +1,12 @@ +from odoo.http import Controller, route, Response + +KNOWN_HASHES=[] + + +class TestRangeController(Controller): + + @route("/auth_password_pwned/range/", type="http", auth="none") + def test_pwned_range(self, range): + return Response("\n".join([ + f"{k[len(range):]}:1" for k in KNOWN_HASHES if k.startswith(range) + ]), content_type="text/plain", status=200) diff --git a/auth_password_pwned/models/__init__.py b/auth_password_pwned/models/__init__.py new file mode 100644 index 0000000000..8835165330 --- /dev/null +++ b/auth_password_pwned/models/__init__.py @@ -0,0 +1 @@ +from . import res_users diff --git a/auth_password_pwned/models/res_users.py b/auth_password_pwned/models/res_users.py new file mode 100644 index 0000000000..46de82666a --- /dev/null +++ b/auth_password_pwned/models/res_users.py @@ -0,0 +1,63 @@ +import hashlib +import logging + +import requests + +from odoo import _, models +from odoo.exceptions import UserError + +_logger = logging.getLogger(__name__) + + +class ResUsers(models.Model): + _inherit = "res.users" + + def _set_password(self): + self._passwordshavebeenpwned(self.mapped("password")) + + return super()._set_password() + + def _passwordshavebeenpwned(self, passwords): + for password in passwords: + if self._passwordhasbeenpwned(password): + raise UserError( + _("Password is already pwned and can no longer be used.") + ) + + def _passwordhasbeenpwned(self, password): + params = self.env["ir.config_parameter"].sudo() + api_url = params.get_param( + "auth_password_pwned.range_url", + default="https://api.pwnedpasswords.com/range/", + ) + if api_url[-1] == "/": + api_url = api_url[:-1] + + password_hash = hashlib.sha1(password.encode("utf-8")).hexdigest().upper() + try: + r = requests.get( + "{api_url}/{hash}".format(api_url=api_url, hash=password_hash[:5]), + headers={ + "User-Agent": "Odoo OCA auth_password_pwned" + " https://github.com/OCA/server-auth", + }, + ) + r.raise_for_status() + response = r.text + return password_hash[5:] in response + except ( + requests.exceptions.HTTPError, + requests.exceptions.RequestException, + ) as error: + if self.env.user.has_group("base.group_system"): + # for admins display a message for them being able to fix the issue + raise UserError( + _(f"{api_url} cannot be reached: {error}").format(api_url, error) + ) from error + else: + # for other users log a warning + _logger.warning( + _(f"{api_url} cannot be reached: {error}").format(api_url, error) + ) + # and let them log into the system (if they have the correct password) + return False diff --git a/auth_password_pwned/readme/CONFIGURE.rst b/auth_password_pwned/readme/CONFIGURE.rst new file mode 100644 index 0000000000..2411475f36 --- /dev/null +++ b/auth_password_pwned/readme/CONFIGURE.rst @@ -0,0 +1,10 @@ +ir.config_parameter options +~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +The following config parameters change the behaviour of this addon. + +``auth_password_pwned.range_url`` *string* (Default: https://api.pwnedpasswords.com/range/) + + Change the url the plugins checks hashes against. Needs to behave like described in + https://haveibeenpwned.com/API/v3#SearchingPwnedPasswordsByRange . This is intended to be used for a company mirror + of the API. diff --git a/auth_password_pwned/readme/CONTRIBUTORS.rst b/auth_password_pwned/readme/CONTRIBUTORS.rst new file mode 100644 index 0000000000..405e62b912 --- /dev/null +++ b/auth_password_pwned/readme/CONTRIBUTORS.rst @@ -0,0 +1,3 @@ + +* `WT-IO-IT GmbH `_: + * Andreas Perhab diff --git a/auth_password_pwned/readme/DESCRIPTION.rst b/auth_password_pwned/readme/DESCRIPTION.rst new file mode 100644 index 0000000000..568d00c728 --- /dev/null +++ b/auth_password_pwned/readme/DESCRIPTION.rst @@ -0,0 +1,4 @@ +This module enforces passwords to be changed once the have appeared in a data breach. + +It uses https://haveibeenpwned.com/API/v3#SearchingPwnedPasswordsByRange to check if the password has appeared in any +data breaches. A great resource provided by Troy Hunt https://haveibeenpwned.com/About . diff --git a/auth_password_pwned/readme/USAGE.rst b/auth_password_pwned/readme/USAGE.rst new file mode 100644 index 0000000000..392e8ceb7a --- /dev/null +++ b/auth_password_pwned/readme/USAGE.rst @@ -0,0 +1 @@ +Install the plugin to force the users to change their password once it is considered to be publicly known. diff --git a/auth_password_pwned/static/description/index.html b/auth_password_pwned/static/description/index.html new file mode 100644 index 0000000000..2e87957d0c --- /dev/null +++ b/auth_password_pwned/static/description/index.html @@ -0,0 +1,450 @@ + + + + + +Password Pwned Check + + + +
+

Password Pwned Check

+ + +

Beta License: AGPL-3 OCA/server-auth Translate me on Weblate Try me on Runboat

+

This module enforces passwords to be changed once the have appeared in a data breach.

+

It uses https://haveibeenpwned.com/API/v3#SearchingPwnedPasswordsByRange to check if the password has appeared in any +data breaches. A great resource provided by Troy Hunt https://haveibeenpwned.com/About .

+

Table of contents

+ +
+

Configuration

+
+

ir.config_parameter options

+

The following config parameters change the behaviour of this addon.

+

auth_password_pwned.range_url string (Default: https://api.pwnedpasswords.com/range/)

+
+Change the url the plugins checks hashes against. Needs to behave like described in +https://haveibeenpwned.com/API/v3#SearchingPwnedPasswordsByRange . This is intended to be used for a company mirror +of the API.
+
+
+
+

Usage

+

Install the plugin to force the users to change their password once it is considered to be publicly known.

+
+
+

Bug Tracker

+

Bugs are tracked on GitHub Issues. +In case of trouble, please check there if your issue has already been reported. +If you spotted it first, help us to smash it by providing a detailed and welcomed +feedback.

+

Do not contact contributors directly about support or help with technical issues.

+
+
+

Credits

+
+

Authors

+
    +
  • WT-IO-IT GmbH
    • +
+
+
+

Contributors

+ +
+
+

Maintainers

+

This module is maintained by the OCA.

+Odoo Community Association +

OCA, or the Odoo Community Association, is a nonprofit organization whose +mission is to support the collaborative development of Odoo features and +promote its widespread use.

+

This module is part of the OCA/server-auth project on GitHub.

+

You are welcome to contribute. To learn how please visit https://odoo-community.org/page/Contribute.

+
+
+
+ + diff --git a/auth_password_pwned/static/tests/tours/change_password_test_tour_pwned.js b/auth_password_pwned/static/tests/tours/change_password_test_tour_pwned.js new file mode 100644 index 0000000000..215289ed9f --- /dev/null +++ b/auth_password_pwned/static/tests/tours/change_password_test_tour_pwned.js @@ -0,0 +1,62 @@ +/** @odoo-module **/ + +import tour from 'web_tour.tour'; + +/** + * This tour depends on data created by python test in charge of launching it. + * It is not intended to work when launched from interface. + * @see auth_password_pwned/tests/test_auth_password_pwned.py + */ +tour.register('auth_password_pwned/static/tests/tours/change_password_test_tour_pwned.js', { + test: true, +}, [{ + content: "Open Settings", + trigger: ".o_app.o_menuitem:contains('Settings')", +}, { + content: "Open Users & Companies Dropdown", + trigger: ".o_main_navbar .o_menu_sections .o-dropdown:contains('Users & Companies') button", +}, { + content: "Open Users Lists", + trigger: ".o_main_navbar .o_menu_sections .o-dropdown:contains('Users & Companies') .dropdown-item:contains('Users')", +}, { + content: "Wait for users list to start loading", + trigger: "body:contains('Loading')", + run: () => null, +}, { + content: "Wait for loaded users list", + trigger: "body:not(:contains('Loading'))", + run: () => null, +}, { + content: "Select Demo User", + trigger: ".o_content tr:contains('Demo') .o_list_record_selector", +}, { + content: "Wait for Demo User to be selected", + trigger: ".o_content tr:contains('Demo') input[type='checkbox']:checked", + run: () => null, +}, { + content: "Open Actions Menu", + trigger: ".o_action_manager button:contains('Action')", +}, { + content: "Open Change Passwords Dialog", + trigger: ".o_action_manager .dropdown.show a.dropdown-item:contains('Change Password')", +}, { + content: "Enable input for setting Pwned Password", + trigger: ".modal-content tr:contains('demo')", + run: function(actions) { + var i=0; + while(this.$anchor.find("input[name='new_passwd']").length <= 0) { + actions.click(this.$anchor.find("div")); + i++; + if (i > 1000) assert(false); + } + } +}, { + content: "Set Pwned Password", + trigger: ".modal-content tr:contains('demo') input[name='new_passwd']", + run: "text demo", +}, { + content: "Change Password", + trigger: ".modal-footer btn-primary", +}, { + //TODO verify that alert is shown +}]); diff --git a/auth_password_pwned/static/tests/tours/login_test_tour_ok.js b/auth_password_pwned/static/tests/tours/login_test_tour_ok.js new file mode 100644 index 0000000000..661902da67 --- /dev/null +++ b/auth_password_pwned/static/tests/tours/login_test_tour_ok.js @@ -0,0 +1,28 @@ +/** @odoo-module **/ + +import tour from 'web_tour.tour'; + +/** + * This tour depends on data created by python test in charge of launching it. + * It is not intended to work when launched from interface. + * @see auth_password_pwned/tests/test_auth_password_pwned.py + */ +tour.register('auth_password_pwned/static/tests/tours/login_test_tour_ok.js', { + test: true, +}, [{ + content: "Set login", + trigger: ".oe_login_form #login", + run: "text testuser", +}, { + content: "Set password", + trigger: ".oe_login_form #password", + run: "text testuser", +}, { + content: "Login to backend", + trigger: ".oe_login_form button[type='submit']", +}, { + content: "Check that backend is loading", + trigger: ".o_web_client", + // We are checking the error message here + run: () => null, +}]); diff --git a/auth_password_pwned/static/tests/tours/login_test_tour_pwned.js b/auth_password_pwned/static/tests/tours/login_test_tour_pwned.js new file mode 100644 index 0000000000..8f98ec7e6d --- /dev/null +++ b/auth_password_pwned/static/tests/tours/login_test_tour_pwned.js @@ -0,0 +1,28 @@ +/** @odoo-module **/ + +import tour from 'web_tour.tour'; + +/** + * This tour depends on data created by python test in charge of launching it. + * It is not intended to work when launched from interface. + * @see auth_password_pwned/tests/test_auth_password_pwned.py + */ +tour.register('auth_password_pwned/static/tests/tours/login_test_tour_pwned.js', { + test: true, +}, [{ + content: "Set login", + trigger: ".oe_login_form #login", + run: "text testpassword", +}, { + content: "Set password", + trigger: ".oe_login_form #password", + run: "text testpassword", +}, { + content: "Try to login to backend", + trigger: ".oe_login_form button[type='submit']", +}, { + content: "Check that there is a warning for an unsafe password", + trigger: ".oe_login_form .alert:contains('This password is known by third parties an email has been sent with instructions how to reset it.')", + // We are checking the error message here + run: () => null, +}]); diff --git a/auth_password_pwned/tests/__init__.py b/auth_password_pwned/tests/__init__.py new file mode 100644 index 0000000000..54c4ee4cf7 --- /dev/null +++ b/auth_password_pwned/tests/__init__.py @@ -0,0 +1 @@ +from . import test_auth_password_pwned diff --git a/auth_password_pwned/tests/test_auth_password_pwned.py b/auth_password_pwned/tests/test_auth_password_pwned.py new file mode 100644 index 0000000000..45f8a4fae2 --- /dev/null +++ b/auth_password_pwned/tests/test_auth_password_pwned.py @@ -0,0 +1,46 @@ + +from odoo import Command +from odoo.tests.common import HttpCase, tagged +from odoo.addons.auth_password_pwned.controllers import test_controllers + + +@tagged('-at_install', 'post_install', 'auth_password_pwned') +class TestPwnedPasswords(HttpCase): + + def setUp(self): + super(TestPwnedPasswords, self).setUp() + self.env['ir.config_parameter'].set_param("auth_password_pwned.range_url", "http://localhost:8069/auth_password_pwned/range/") + test_controllers.KNOWN_HASHES.clear() + + def test_login_with_pwned_password(self): + return + self.env["res.users"].create( + { + "login": "testpassword", + "password": "testpassword", + "name": "my test user with unsafe password", + "groups_id": [Command.link(self.env.ref("base.group_user").id)], + } + ) + test_controllers.KNOWN_HASHES += ["8BB6118F8FD6935AD0876A3BE34A717D32708FFD"] # sha1sum of testpassword + self.start_tour("/web/login","auth_password_pwned/static/tests/tours/login_test_tour_pwned.js", login="testpassword") + + def test_login_with_ok_password(self): + return + self.env["res.users"].create( + { + "login": "testuser", + "password": "testuser", + "name": "my test user with safe password", + "groups_id": [Command.link(self.env.ref("base.group_user").id)], + } + ) + self.start_tour("/web/login","auth_password_pwned/static/tests/tours/login_test_tour_ok.js", login="testuser") + + def test_backend_password_pwned_backend(self): + test_controllers.KNOWN_HASHES += ["89E495E7941CF9E40E6980D14A16BF023CCD4C91"] # sha1sum of demo + self.start_tour("/web", "auth_password_pwned/static/tests/tours/change_password_test_tour_pwned.js", login="admin") + + def test_backend_changing_ok_password(self): + # TODO + pass diff --git a/setup/auth_password_pwned/odoo/addons/auth_password_pwned b/setup/auth_password_pwned/odoo/addons/auth_password_pwned new file mode 120000 index 0000000000..6208ee1a5d --- /dev/null +++ b/setup/auth_password_pwned/odoo/addons/auth_password_pwned @@ -0,0 +1 @@ +../../../../auth_password_pwned \ No newline at end of file diff --git a/setup/auth_password_pwned/setup.py b/setup/auth_password_pwned/setup.py new file mode 100644 index 0000000000..28c57bb640 --- /dev/null +++ b/setup/auth_password_pwned/setup.py @@ -0,0 +1,6 @@ +import setuptools + +setuptools.setup( + setup_requires=['setuptools-odoo'], + odoo_addon=True, +)