password_security: Signup freezes with very large password

[jans23]

Module

password_security

Describe the bug

When signing up, entering all details and a very large password the browser window freezes.

To Reproduce

Affected versions: 12.0 and 15.0 and potentially other versions

Steps to reproduce the behavior:

1. Enable free user signup
2. Open /web/signup URL
3. Fill all fields
4. Enter a large password into the password field (e.g. copy password from password.txt
5. The browser window (Firefox, Chrome) freezes

Expected behavior: The maximum password length should be checked by the module and an error should be presented saying that the password's maximum length has been exceeded.

[astirpe]

This issue may be caused by zxcvbn library. The execution of this line https://github.com/dwolfhub/zxcvbn-python/blob/master/zxcvbn/__init__.py#L25 is very slow, as described in #482 (comment)

@jans23 you may try to comment out these lines https://github.com/OCA/server-auth/blob/15.0/password_security/models/res_users.py#L138-L140 and see if the problem does not occur anymore. If that is the case, we should implement a proper fix.

[jans23]

This doesn't solve the issue.

I tested it this way:

1. On the test server, commented the specified lines.
2. As and admin in Modules -> password_security I clicked Upgrade.
3. Opened a private browser and executed the steps above to trigger the issue.

[astirpe]

@jans23 between point 1 and 2 you need an extra step to restart the odoo server I guess

[jans23]

After restarting Odoo and then upgrading password_security, I get the following error which prevents me from testing.

Error:
Odoo Server Error

Traceback (most recent call last):
  File "/srv/odoo/odoo/parts/odoo/odoo/models.py", line 1128, in _validate_fields
    check(self)
  File "/srv/odoo/odoo/parts/odoo/odoo/addons/base/models/ir_ui_view.py", line 351, in _check_xml
    self.postprocess_and_fields(view.model, view_doc, view.id)
  File "/srv/odoo/odoo/parts/odoo/odoo/addons/base/models/ir_ui_view.py", line 1138, in postprocess_and_fields
    self.raise_view_error(message, view_id)
  File "/srv/odoo/odoo/parts/odoo/odoo/addons/base/models/ir_ui_view.py", line 568, in raise_view_error
    raise ValueError(message)
ValueError: Field `password_expiration` does not exist

Error context:
View `res.config.settings.form.password_security`
[view_id: 4768, xml_id: password_security.res_config_settings_view_form, model: res.config.settings, parent_id: 2450]

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/srv/odoo/odoo/parts/odoo/odoo/tools/convert.py", line 758, in parse
    self._tags[rec.tag](rec, de, mode=mode)
  File "/srv/odoo/odoo/parts/odoo/odoo/tools/convert.py", line 663, in _tag_record
    record = model.with_context(rec_context)._load_records([data], self.mode == 'update')
  File "/srv/odoo/odoo/parts/odoo/odoo/models.py", line 3883, in _load_records
    data['record']._load_records_write(data['values'])
  File "/srv/odoo/odoo/parts/odoo/odoo/addons/base/models/ir_ui_view.py", line 1542, in _load_records_write
    super(View, self)._load_records_write(values)
  File "/srv/odoo/odoo/parts/odoo/odoo/models.py", line 3821, in _load_records_write
    self.write(values)
  File "/srv/odoo/odoo/parts/odoo/odoo/addons/base/models/ir_ui_view.py", line 445, in write
    res = super(View, self).write(self._compute_defaults(vals))
  File "/srv/odoo/odoo/parts/odoo/odoo/models.py", line 3392, in write
    fields[0].determine_inverse(records)
  File "/srv/odoo/odoo/parts/odoo/odoo/fields.py", line 1200, in determine_inverse
    getattr(records, self.inverse)()
  File "/srv/odoo/odoo/parts/odoo/odoo/addons/base/models/ir_ui_view.py", line 275, in _inverse_arch
    view.write(data)
  File "/srv/odoo/odoo/parts/odoo/odoo/addons/base/models/ir_ui_view.py", line 445, in write
    res = super(View, self).write(self._compute_defaults(vals))
  File "/srv/odoo/odoo/parts/odoo/odoo/models.py", line 3366, in write
    self._write(store_vals)
  File "/srv/odoo/odoo/parts/odoo/odoo/models.py", line 3502, in _write
    self._validate_fields(vals)
  File "/srv/odoo/odoo/parts/odoo/odoo/models.py", line 1132, in _validate_fields
    raise ValidationError("%s\n\n%s" % (_("Error while validating constraint"), tools.ustr(e)))
odoo.exceptions.ValidationError: ('Error while validating constraint\n\nField `password_expiration` does not exist\n\nError context:\nView `res.config.settings.form.password_security`\n[view_id: 4768, xml_id: password_security.res_config_settings_view_form, model: res.config.settings, parent_id: 2450]', None)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/srv/odoo/odoo/parts/odoo/odoo/http.py", line 656, in _handle_exception
    return super(JsonRequest, self)._handle_exception(exception)
  File "/srv/odoo/odoo/parts/odoo/odoo/http.py", line 314, in _handle_exception
    raise pycompat.reraise(type(exception), exception, sys.exc_info()[2])
  File "/srv/odoo/odoo/parts/odoo/odoo/tools/pycompat.py", line 87, in reraise
    raise value
  File "/srv/odoo/odoo/parts/odoo/odoo/http.py", line 698, in dispatch
    result = self._call_function(**self.params)
  File "/srv/odoo/odoo/parts/odoo/odoo/http.py", line 346, in _call_function
    return checked_call(self.db, *args, **kwargs)
  File "/srv/odoo/odoo/parts/odoo/odoo/service/model.py", line 98, in wrapper
    return f(dbname, *args, **kwargs)
  File "/srv/odoo/odoo/parts/odoo/odoo/http.py", line 339, in checked_call
    result = self.endpoint(*a, **kw)
  File "/srv/odoo/odoo/parts/odoo/odoo/http.py", line 941, in __call__
    return self.method(*args, **kw)
  File "/srv/odoo/odoo/parts/odoo/odoo/http.py", line 519, in response_wrap
    response = f(*args, **kw)
  File "/srv/odoo/odoo/parts/odoo/addons/web/controllers/main.py", line 971, in call_button
    action = self._call_kw(model, method, args, {})
  File "/srv/odoo/odoo/parts/odoo/addons/web/controllers/main.py", line 959, in _call_kw
    return call_kw(request.env[model], method, args, kwargs)
  File "/srv/odoo/odoo/parts/odoo/odoo/api.py", line 759, in call_kw
    return _call_kw_multi(method, model, args, kwargs)
  File "/srv/odoo/odoo/parts/odoo/odoo/api.py", line 746, in _call_kw_multi
    result = method(recs, *args, **kwargs)
  File "/usr/local/lib/python3.6/site-packages/decorator.py", line 232, in fun
    return caller(func, *(extras + args), **kw)
  File "/srv/odoo/odoo/parts/odoo/odoo/addons/base/models/ir_module.py", line 76, in check_and_log
    return method(self, *args, **kwargs)
  File "/srv/odoo/odoo/parts/odoo/odoo/addons/base/models/ir_module.py", line 629, in button_immediate_upgrade
    return self._button_immediate_function(type(self).button_upgrade)
  File "/srv/odoo/odoo/parts/odoo/odoo/addons/base/models/ir_module.py", line 563, in _button_immediate_function
    modules.registry.Registry.new(self._cr.dbname, update_module=True)
  File "/srv/odoo/odoo/parts/odoo/odoo/modules/registry.py", line 86, in new
    odoo.modules.load_modules(registry._db, force_demo, status, update_module)
  File "/srv/odoo/odoo/parts/odoo/odoo/modules/loading.py", line 417, in load_modules
    force, status, report, loaded_modules, update_module, models_to_check)
  File "/srv/odoo/odoo/parts/odoo/odoo/modules/loading.py", line 313, in load_marked_modules
    perform_checks=perform_checks, models_to_check=models_to_check
  File "/srv/odoo/odoo/parts/odoo/odoo/modules/loading.py", line 222, in load_module_graph
    load_data(cr, idref, mode, kind='data', package=package, report=report)
  File "/srv/odoo/odoo/parts/odoo/odoo/modules/loading.py", line 68, in load_data
    tools.convert_file(cr, package.name, filename, idref, mode, noupdate, kind, report)
  File "/srv/odoo/odoo/parts/odoo/odoo/tools/convert.py", line 802, in convert_file
    convert_xml_import(cr, module, fp, idref, mode, noupdate, report)
  File "/srv/odoo/odoo/parts/odoo/odoo/tools/convert.py", line 865, in convert_xml_import
    obj.parse(doc.getroot(), mode=mode)
  File "/srv/odoo/odoo/parts/odoo/odoo/tools/convert.py", line 764, in parse
    exc_info[2]
  File "/srv/odoo/odoo/parts/odoo/odoo/tools/pycompat.py", line 86, in reraise
    raise value.with_traceback(tb)
  File "/srv/odoo/odoo/parts/odoo/odoo/tools/convert.py", line 758, in parse
    self._tags[rec.tag](rec, de, mode=mode)
  File "/srv/odoo/odoo/parts/odoo/odoo/tools/convert.py", line 663, in _tag_record
    record = model.with_context(rec_context)._load_records([data], self.mode == 'update')
  File "/srv/odoo/odoo/parts/odoo/odoo/models.py", line 3883, in _load_records
    data['record']._load_records_write(data['values'])
  File "/srv/odoo/odoo/parts/odoo/odoo/addons/base/models/ir_ui_view.py", line 1542, in _load_records_write
    super(View, self)._load_records_write(values)
  File "/srv/odoo/odoo/parts/odoo/odoo/models.py", line 3821, in _load_records_write
    self.write(values)
  File "/srv/odoo/odoo/parts/odoo/odoo/addons/base/models/ir_ui_view.py", line 445, in write
    res = super(View, self).write(self._compute_defaults(vals))
  File "/srv/odoo/odoo/parts/odoo/odoo/models.py", line 3392, in write
    fields[0].determine_inverse(records)
  File "/srv/odoo/odoo/parts/odoo/odoo/fields.py", line 1200, in determine_inverse
    getattr(records, self.inverse)()
  File "/srv/odoo/odoo/parts/odoo/odoo/addons/base/models/ir_ui_view.py", line 275, in _inverse_arch
    view.write(data)
  File "/srv/odoo/odoo/parts/odoo/odoo/addons/base/models/ir_ui_view.py", line 445, in write
    res = super(View, self).write(self._compute_defaults(vals))
  File "/srv/odoo/odoo/parts/odoo/odoo/models.py", line 3366, in write
    self._write(store_vals)
  File "/srv/odoo/odoo/parts/odoo/odoo/models.py", line 3502, in _write
    self._validate_fields(vals)
  File "/srv/odoo/odoo/parts/odoo/odoo/models.py", line 1132, in _validate_fields
    raise ValidationError("%s\n\n%s" % (_("Error while validating constraint"), tools.ustr(e)))
odoo.tools.convert.ParseError: "Error while validating constraint

Field `password_expiration` does not exist

Error context:
View `res.config.settings.form.password_security`
[view_id: 4768, xml_id: password_security.res_config_settings_view_form, model: res.config.settings, parent_id: 2450]
None" while parsing /srv/odoo/odoo/parts/OCA/server-auth/password_security/views/res_config_settings_views.xml:7, near
<record id="res_config_settings_view_form" model="ir.ui.view">
        <field name="name">res.config.settings.form.password_security</field>
        <field name="model">res.config.settings</field>
        <field name="inherit_id" ref="auth_password_policy.res_config_settings_view_form"/>
        <field name="arch" type="xml">
            <data><!-- We hide Odoo's minlength sections so it does not create confusion -->
            <xpath expr="//label[@for='minlength']/../.." position="attributes">
                <attribute name="style">display: none</attribute>
            </xpath>

            <!-- Add our password policy fields -->
            <xpath expr="//div[@id='access_rights']" position="before">
                <div class="col-12 col-lg-6 o_setting_box" title="Password Policy">
                    <div class="o_setting_left_pane"/>
                    <div class="o_setting_right_pane">
                        <label string="Password Policy" for="password_expiration"/>
                        <div class="content-group">
                            <div class="mt16">
                                <span>Password expires in <field name="password_expiration" class="oe_inline"/> days.</span>
                            </div>
                            <div class="mt16">
                                <span>User can change password in <field name="password_minimum" class="oe_inline"/> hours again.</span>
                            </div>
                            <div class="mt16">
                                <span>Disallow reuse of <field name="password_history" class="oe_inline"/> previous passwords.</span>
                                <div class="text-muted">
                                    Use negative number for infinite, or 0 to disable
                                </div>
                            </div>
                             <div class="mt16">
                                <span>Minimum number of characters <field name="password_length" class="oe_inline"/></span>
                            </div>
                            <div class="mt16">
                                <span>Minimum number of lowercase characters <field name="password_lower" class="oe_inline"/></span>
                            </div>
                            <div class="mt16">
                                <span>Minimum number of uppercase characters <field name="password_upper" class="oe_inline"/></span>
                            </div>
                            <div class="mt16">
                                <span>Minimum number of numeric characters <field name="password_numeric" class="oe_inline"/></span>
                            </div>
                            <div class="mt16">
                                <span>Minimum number of special characters <field name="password_special" class="oe_inline"/></span>
                            </div>
                            <div class="mt16">
                                <span>Minimum number of strength estimation <field name="password_estimate" class="oe_inline"/></span>
                            </div>
                        </div>
                    </div>
                </div>
            </xpath>
        </data></field>
    </record>

[astirpe]

It's because a field was removed in the mantime and the module needs to be upgraded (point 2). You could force the upgrade of the module by command line.

[jans23]

I tested again on 15.0 but the issue still exists with the lines being commented out.

[github-actions]

There hasn't been any activity on this issue in the past 6 months, so it has been marked as stale and it will be closed automatically if no further activity occurs in the next 30 days.
If you want this issue to never become stale, please ask a PSC member to apply the "no stale" label.