Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[16.0][REV] password_security: Restore password_estimate. #687

Open
wants to merge 1 commit into
base: 16.0
Choose a base branch
from

Conversation

amh-mw
Copy link

@amh-mw amh-mw commented Sep 4, 2024

This reverts commit c8d5d68 which should not have removed password_estimate as part of the migration to 16.0. #482

I do think it is worth having the conversation raised by @astirpe in #482 (comment)

I just found out that when a new user is trying to signup by entering a very large password, there is a critical performance issue.
It's caused by the adoption of zxcvbn library, in particular the execution of this line https://github.com/dwolfhub/zxcvbn-python/blob/master/zxcvbn/__init__.py#L25 is very slow. That could potentially cause a DDOS attack in my opinion.
Probably that's also the reason of #487 but I didn't investigate in deep that issue.
So I'm going to remove the password estimate check functionality from this module and also remove the dependency on zxcvbn, because the password estimation is already provided by "Password Meter" widget by standard Odoo.

This reverts commit c8d5d68 which
should not have removed password_estimate as part of the migration
to 16.0.

OCA#482
@amh-mw amh-mw force-pushed the 16.0-password_security-estimate branch from 3fe632a to 8b8c2bc Compare September 4, 2024 18:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant