From 2c959246b762ffe18cd1cfa028f1335fc9889f84 Mon Sep 17 00:00:00 2001 From: niv-openerp Date: Thu, 13 Jun 2013 13:34:58 +0200 Subject: [PATCH] even more security bzr revid: nicolas.vanhoren@openerp.com-20130613113458-2ww1cbb9q5nz6ayk --- addons/web/session.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/addons/web/session.py b/addons/web/session.py index 0dbda02352d..a0c924975ca 100644 --- a/addons/web/session.py +++ b/addons/web/session.py @@ -45,7 +45,8 @@ class Model(object): def proxy(*args, **kw): # Can't provide any retro-compatibility for this case, so we check it and raise an Exception # to tell the programmer to adapt his code - if self.session._db != http.request.db or self.session._uid != http.request.uid: + if not http.request.db or not http.request.uid or self.session._db != http.request.db \ + or self.session._uid != http.request.uid: raise Exception("Trying to use Model with badly configured database or user.") mod = http.request.registry.get(self.model)