[FIX] apply same visibility rules as base

odoo · Apr 10, 2015 · 8d750ec · 8d750ec
1 parent d0493ee
commit 8d750ec
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 2 deletions.
diff --git a/addons/auth_crypt/auth_crypt.py b/addons/auth_crypt/auth_crypt.py
@@ -5,6 +5,8 @@
 import openerp
 from openerp.osv import fields, osv
 
+openerp.addons.base.res.res_users.USER_PRIVATE_FIELDS.append('password_crypt')
+
 _logger = logging.getLogger(__name__)
 
 default_crypt_context = CryptContext(

diff --git a/openerp/addons/base/res/res_users.py b/openerp/addons/base/res/res_users.py
@@ -37,6 +37,9 @@
 
 _logger = logging.getLogger(__name__)
 
+# Only users who can modify the user (incl. the user herself) see the real contents of these fields
+USER_PRIVATE_FIELDS = ['password']
+
 #----------------------------------------------------------
 # Basic res.groups and res.users
 #----------------------------------------------------------
@@ -280,8 +283,10 @@ def _get_default_image(self, cr, uid, context=None):
 
     def read(self, cr, uid, ids, fields=None, context=None, load='_classic_read'):
         def override_password(o):
-            if 'password' in o and ('id' not in o or o['id'] != uid):
-                o['password'] = '********'
+            if ('id' not in o or o['id'] != uid):
+                for f in USER_PRIVATE_FIELDS:
+                    if f in o:
+                        o[f] = '********'
             return o
 
         if fields and (ids == [uid] or ids == uid):