Prevent users from exporting passwords in v7?

Question

Any user with access rights to the user list can export every single password in the system. For one, storing plain text passwords in any form is poor security and having anyone with access to all users' paswords is also poor security. You can't allow a user to create other users but ensure they can't steal everyone's passwords.

Is there any way to prevent users having access to other people's passwords even if they have the rights to create users. Example, you have an HR user that can create

Fabrice Henrion (fhe) · Answer

Use the module /auth_crypt/
None [1] https://www.odoo.com/apps/modules/7.0/auth_crypt/

[1] https://www.odoo.com/apps/modules/7.0/auth_crypt/

Ivan · Answer

The auth_crypt that Fabrice had suggested will encrypt the password so that it is not stored in clear text. However, I think it is still a better idea to prevent exporting password all-together (anyway, who want to export password without any malice objective in the first place). A list of enrypted passwords will make it easier for attacker to reverse engineer the hash algorithm. I'd recommend inheriting the export_data method in the res.users and remove password field from the fields_to_export.

المنشورات ذات الصلة	الردود	أدوات العرض
[8] Export data in Excel security modules export users excel	0 فبراير 18	5809
Can I force a user to change their password? security users	1 مارس 15	5938
Users reporting when the login it shows them as a different user security users odoo10	0 يونيو 25	3098
Keep Getting "The user cannot have more than one user types." تم الحل security users group	1 نوفمبر 21	6732
Postgres server password inside openerp-server.conf file!! تم الحل security password database	2 ديسمبر 23	33851

لقد تم الإبلاغ عن هذا السؤال

هل أعجبك النقاش؟ لا تكن مستمعاً فقط. شاركنا!