diff --git a/bin/addons/base/ir/ir_actions.py b/bin/addons/base/ir/ir_actions.py
index 4432ebe62e9..6c51ab2f771 100644
--- a/bin/addons/base/ir/ir_actions.py
+++ b/bin/addons/base/ir/ir_actions.py
@@ -532,7 +532,6 @@ class actions_server(osv.osv):
 
     def run(self, cr, uid, ids, context={}):
         logger = netsvc.Logger()
-        print "::ODS",ids
         for action in self.browse(cr, uid, ids, context):
             obj_pool = self.pool.get(action.model_id.model)
             obj = obj_pool.browse(cr, uid, context['active_id'], context=context)
@@ -554,20 +553,26 @@ class actions_server(osv.osv):
                 return self.pool.get(action.action_id.type)\
                     .read(cr, uid, action.action_id.id, context=context)
 
-            if action.state == 'code':
-                localdict = {
-                    'self': self.pool.get(action.model_id.model),
-                    'context': context,
-                    'time': time,
-                    'ids': ids,
-                    'cr': cr,
-                    'uid': uid,
-                    'object':obj,
-                    'obj': obj,
-                }
-                exec action.code in localdict
-                if 'action' in localdict:
-                    return localdict['action']
+                if config['server_actions_allow_code']:
+                    localdict = {
+                        'self': self.pool.get(action.model_id.model),
+                        'context': context,
+                        'time': time,
+                        'ids': ids,
+                        'cr': cr,
+                        'uid': uid,
+                        'object':obj,
+                        'obj': obj,
+                        }
+                    exec action.code in localdict
+                    if 'action' in localdict:
+                        return localdict['action']
+                else:
+                    netsvc.Logger().notifyChannel(
+                        self._name, netsvc.LOG_ERROR,
+                        "%s is a `code` server action, but "
+                        "it isn't allowed in this configuration.\n\n"
+                        "See server options to enable it"%action)
 
             if action.state == 'email':
                 user = config['email_from']
diff --git a/bin/tools/config.py b/bin/tools/config.py
index a92948b8af0..46273d681bb 100644
--- a/bin/tools/config.py
+++ b/bin/tools/config.py
@@ -124,7 +124,6 @@ class configmanager(object):
         parser.add_option("--assert-exit-level", dest='assert_exit_level', type="choice", choices=self._LOGLEVELS.keys(),
                           help="specify the level at which a failed assertion will stop the server. Accepted values: %s" % (self._LOGLEVELS.keys(),))
         parser.add_option('--price_accuracy', dest='price_accuracy', default='2', help='deprecated since v6.0, replaced by module decimal_precision')
-        parser.add_option('--no-database-list', action="store_false", dest='list_db', default=True, help="disable the ability to return the list of databases")
 
         if self.has_ssl:
             group = optparse.OptionGroup(parser, "SSL Configuration")
@@ -202,6 +201,13 @@ class configmanager(object):
                          action="callback", callback=self._check_addons_path, nargs=1, type="string")
         parser.add_option_group(group)
 
+        security = optparse.OptionGroup(parser, 'Security-related options')
+        security.add_option('--no-database-list', action="store_false", dest='list_db', default=True, help="disable the ability to return the list of databases")
+        security.add_option('--enable-code-actions', action='store_true',
+                            dest='server_actions_allow_code', default=False,
+                            help='Enables server actions of state "code". Warning, this is a security risk.')
+        parser.add_option_group(security)
+        
     def parse_config(self):
         (opt, args) = self.parser.parse_args()
 
@@ -261,7 +267,8 @@ class configmanager(object):
                 self.options[arg] = getattr(opt, arg)
 
         keys = ['language', 'translate_out', 'translate_in', 'debug_mode',
-                'stop_after_init', 'logrotate', 'without_demo', 'netrpc', 'xmlrpc', 'syslog', 'list_db']
+                'stop_after_init', 'logrotate', 'without_demo', 'netrpc', 'xmlrpc', 'syslog',
+                'list_db', 'server_actions_allow_code']
 
         if self.has_ssl and not self.options['secure']:
             keys.append('secure')