[FIX] potential bug in server-side web framework, now forbids users to call method...

bzr revid: nicolas.vanhoren@openerp.com-20131018125727-qtkzkiwkhw4z78kr

diff --git a/addons/web/http.py b/addons/web/http.py
index 7e12a71..4bda581 100644 (file)
--- a/addons/web/http.py
+++ b/addons/web/http.py
@@ -189,6 +189,8 @@ class WebRequest(object):
 
 def auth_method_user():
     request.uid = request.session.uid
+    if not request.uid:
+        raise SessionExpiredException("Session expired")
 
 def auth_method_admin():
     if not request.db: