From 6fa705399bc05d4b0dce5e7181c40a4a5ab8b1c3 Mon Sep 17 00:00:00 2001 From: Fabien Meghazi Date: Fri, 28 Jul 2017 15:55:50 +0200 Subject: [PATCH] [FIX] http/db: handle case when `db_filter` is empty in the config file In such a case the db filtering won't be applied on an empty regex so we use the list of databases passed to `db_name` (--database) as the database list (and we also avoid to list all the databases present on the postgresql cluster) As a side effect, this patch allows to strengthen the postgresql security by preventing Odoo to list all the databases present on the cluster. --- odoo/http.py | 10 ++++++++-- odoo/service/db.py | 8 ++++++++ 2 files changed, 16 insertions(+), 2 deletions(-) diff --git a/odoo/http.py b/odoo/http.py index 89efcbdeb41..56b1f8e6930 100644 --- a/odoo/http.py +++ b/odoo/http.py @@ -1504,8 +1504,14 @@ def db_filter(dbs, httprequest=None): d, _, r = h.partition('.') if d == "www" and r: d = r.partition('.')[0] - r = odoo.tools.config['dbfilter'].replace('%h', h).replace('%d', d) - dbs = [i for i in dbs if re.match(r, i)] + if odoo.tools.config['dbfilter']: + r = odoo.tools.config['dbfilter'].replace('%h', h).replace('%d', d) + dbs = [i for i in dbs if re.match(r, i)] + elif odoo.tools.config['db_name']: + # In case --db-filter is not provided and --database is passed, Odoo will + # use the value of --database as a comma seperated list of exposed databases. + exposed_dbs = set(db.strip() for db in odoo.tools.config['db_name'].split(',')) + dbs = sorted(exposed_dbs.intersection(dbs)) return dbs def db_monodb(httprequest=None): diff --git a/odoo/service/db.py b/odoo/service/db.py index d6ff8d15976..d322644e7ca 100644 --- a/odoo/service/db.py +++ b/odoo/service/db.py @@ -319,6 +319,14 @@ def exp_db_exist(db_name): def list_dbs(force=False): if not odoo.tools.config['list_db'] and not force: raise odoo.exceptions.AccessDenied() + + if not odoo.tools.config['dbfilter'] and odoo.tools.config['db_name']: + # In case --db-filter is not provided and --database is passed, Odoo will not + # fetch the list of databases available on the postgres server and instead will + # use the value of --database as comma seperated list of exposed databases. + res = sorted(db.strip() for db in odoo.tools.config['db_name'].split(',')) + return res + chosen_template = odoo.tools.config['db_template'] templates_list = tuple(set(['postgres', chosen_template])) db = odoo.sql_db.db_connect('postgres')