{"action":"created","issue":{"url":"https://api.github.com/repos/odoo/odoo/issues/8029","labels_url":"https://api.github.com/repos/odoo/odoo/issues/8029/labels{/name}","comments_url":"https://api.github.com/repos/odoo/odoo/issues/8029/comments","events_url":"https://api.github.com/repos/odoo/odoo/issues/8029/events","html_url":"https://github.com/odoo/odoo/issues/8029","id":100518169,"number":8029,"title":"[Security] passwords are stored as cleartext in session","user":{"login":"christophlsa","id":115873,"avatar_url":"https://avatars.githubusercontent.com/u/115873?v=3","gravatar_id":"","url":"https://api.github.com/users/christophlsa","html_url":"https://github.com/christophlsa","followers_url":"https://api.github.com/users/christophlsa/followers","following_url":"https://api.github.com/users/christophlsa/following{/other_user}","gists_url":"https://api.github.com/users/christophlsa/gists{/gist_id}","starred_url":"https://api.github.com/users/christophlsa/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/christophlsa/subscriptions","organizations_url":"https://api.github.com/users/christophlsa/orgs","repos_url":"https://api.github.com/users/christophlsa/repos","events_url":"https://api.github.com/users/christophlsa/events{/privacy}","received_events_url":"https://api.github.com/users/christophlsa/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":6,"created_at":"2015-08-12T10:55:00Z","updated_at":"2015-08-13T11:56:01Z","closed_at":"2015-08-13T11:28:10Z","body":"I and @Benniphx found a possible security issue:\r\n\r\nAs you maybe know the sessions are stored in the filesystem (at ~/.local/share/Odoo/sessions). If you open the files you can find the cleartext login names and passwords of the users.\r\n\r\nTo print out all data of the session files you can use these lines:\r\n\r\n```\r\nfrom pickle import load\r\nimport os\r\nfor file in os.listdir('~/.local/share/Odoo/sessions/'):\r\n    f = open(file, 'rb')\r\n    print load(f)\r\n```\r\n\r\nIn my opinion the login data shouldn't be saved as cleartext in the filesystem. Since odoo 8 the module auth_crypt is used to encrypt the password in the database to avoid persons to read the secrets. Everybody who has access to these session files can read the login data of the users. For me this is a security issue."},"comment":{"url":"https://api.github.com/repos/odoo/odoo/issues/comments/130639360","html_url":"https://github.com/odoo/odoo/issues/8029#issuecomment-130639360","issue_url":"https://api.github.com/repos/odoo/odoo/issues/8029","id":130639360,"user":{"login":"wtaferner","id":362478,"avatar_url":"https://avatars.githubusercontent.com/u/362478?v=3","gravatar_id":"","url":"https://api.github.com/users/wtaferner","html_url":"https://github.com/wtaferner","followers_url":"https://api.github.com/users/wtaferner/followers","following_url":"https://api.github.com/users/wtaferner/following{/other_user}","gists_url":"https://api.github.com/users/wtaferner/gists{/gist_id}","starred_url":"https://api.github.com/users/wtaferner/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wtaferner/subscriptions","organizations_url":"https://api.github.com/users/wtaferner/orgs","repos_url":"https://api.github.com/users/wtaferner/repos","events_url":"https://api.github.com/users/wtaferner/events{/privacy}","received_events_url":"https://api.github.com/users/wtaferner/received_events","type":"User","site_admin":false},"created_at":"2015-08-13T11:56:01Z","updated_at":"2015-08-13T11:56:01Z","body":"@antonylesuisse \r\nI am very sorry to hear your PoV. I admit it is hard to fix this BUT referring to your own [security page](https://www.odoo.com/page/security) you write...\r\n\r\n**Password Security**\r\n* Customer passwords are protected with industry-standard PBKDF2+SHA512 encryption (salted + stretched for thousands of rounds)\r\n* Odoo staff does not have access to your password, and cannot retrieve it for you, the only option if you lose it is to reset it\r\n* Login credentials are always transmitted securely over HTTPS\r\n\r\nSo, based on this you should adapt your security page as you say Odoo staff does not have access to passwords which is therefore not true ;-) \r\n\r\nAnyway, this needs to be fixed at some point...maybe something to promote the announced rerun of the security campaign...but still, as you said it is tricky who should be better in fixing this than the software publisher? \r\n\r\n"}}