From 085ad7fcc4d8a288e959ea98e8f74807aa6c5cf1 Mon Sep 17 00:00:00 2001 From: Denis Ledoux Date: Fri, 5 Sep 2014 14:57:20 +0200 Subject: [PATCH] [FIX] web: do not allow to access a database if not matching db-filter --- addons/web/controllers/main.py | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/addons/web/controllers/main.py b/addons/web/controllers/main.py index 584bb3e35b5..6bfc249cc9a 100644 --- a/addons/web/controllers/main.py +++ b/addons/web/controllers/main.py @@ -101,13 +101,13 @@ def db_redirect(req, match_first_only_if_unique): db = False redirect = False + dbs = db_list(req, True) + # 1 try the db in the url db_url = req.params.get('db') - if db_url: + if db_url and db_url in dbs: return (db_url, False) - dbs = db_list(req, True) - # 2 use the database from the cookie if it's listable and still listed cookie_db = req.httprequest.cookies.get('last_used_database') if cookie_db in dbs: @@ -584,6 +584,8 @@ class Home(openerpweb.Controller): @openerpweb.httprequest def login(self, req, db, login, key): + if db not in db_list(req, True): + return werkzeug.utils.redirect('/', 303) return login_and_redirect(req, db, login, key) class WebClient(openerpweb.Controller):