Skip unchanged admin passwords in post-deploy maintenance - #134
Merged
Merged
Conversation
Post-deploy maintenance rewrote the configured administrator password on every deploy, so Odoo emailed a password-change security notice each time. #113 fixed the container startup path; apply the same credential check to ensure_admin_user and keep quotes and backslashes intact in the payload. Refs #112
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
CM website testing still sends an Odoo "Security Update: Password Changed" email on every deploy. The email goes to
admin@localhostand bounces back to the support mailbox. #113 made the container startup path check the password first. Post-deploy maintenance has its own copy of that logic inensure_admin_user, and that copy still wrote the password every time. The 2026-09-29 15:40 UTC notice came from the testing post-deploy run.What changed
ensure_admin_usernow checks the configured password with Odoo's_check_credentialsfirst. It writes only onAccessDenied. A real rotation still goes through Odoo's normal write and still sends a notification. Any other credential-check failure raises instead of writing.repr(json.dumps(...)), as in Avoid password-change notices on unchanged startup #113, so quotes and backslashes in the password survive.Verification
EnsureAdminUserTestscover these cases: the same password twice results in one write; a rotation writes once and then stops; an unexpected check failure does not write. The tests fail against the old code.UNKNOWN(language_sdk_missing) twice in the fresh worktree, including afteruv sync --locked. This is the known preparation debt tracked in Make linked-worktree Python inspection preparation reproducible #111.Owner test notes
Nothing for the owner to test. After this lands and the CM website pin moves to it, testing deploys should stop sending the password-change email.
Refs #112