From 76cd8d2558d2a1fc11681dbc4a134ba06fb698c0 Mon Sep 17 00:00:00 2001
From: Olivier Dony <odo@openerp.com>
Date: Fri, 2 Jun 2017 22:13:36 +0200
Subject: [PATCH] [FIX] tools: verify path before opening

---
 odoo/tools/misc.py | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/odoo/tools/misc.py b/odoo/tools/misc.py
index 36061213003..c54af653a00 100644
--- a/odoo/tools/misc.py
+++ b/odoo/tools/misc.py
@@ -196,7 +196,16 @@ def file_open(name, mode="r", subdir='addons', pathinfo=False):
 
 
 def _fileopen(path, mode, basedir, pathinfo, basename=None):
-    name = os.path.normpath(os.path.join(basedir, path))
+    name = os.path.normpath(os.path.normcase(os.path.join(basedir, path)))
+
+    import odoo.modules as addons
+    paths = addons.module.ad_paths + [config['root_path']]
+    for addons_path in paths:
+        addons_path = os.path.normpath(os.path.normcase(addons_path)) + os.sep
+        if name.startswith(addons_path):
+            break
+    else:
+        raise ValueError("Unknown path: %s" % name)
 
     if basename is None:
         basename = name