pengyuthon/odoo_source
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[FIX] qweb safe_eval: added safe attributes for evaluation. Currently _name is considered as safe; used in publish or edit management (object._name)

Browse Source 
bzr revid: tde@openerp.com-20131011123517-0xd0m7wfvq39s0y0
This commit is contained in:
Christophe Lilo Matthieu
2013-10-11 14:35:17 +02:00
committed by Thibault Delavallée
parent b0d16d0fcc
commit 8a54670c57
1 changed files with 7 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
openerp/tools/safe_eval_qweb.py
+7 -3
View File
@@ -82,13 +82,17 @@ BUILTINS = {
'relativedelta': lambda *a, **kw : relativedelta.relativedelta(*a, **kw),
}
UNSAFE = [str("browse"), str("search"), str("read"), str("unlink"), str("read_group")]
SAFE = [str("_name")]
class qWebSandboxedEnvironment(SandboxedEnvironment):
def is_safe_attribute(self, obj, attr, value):
res = super(qWebSandboxedEnvironment, self).is_safe_attribute(obj, attr, value)
if str(attr) in UNSAFE or not res:
raise SecurityError("access to attribute '%s' of '%s' object is unsafe." % (attr,obj))
if str(attr) in SAFE:
res = True
else:
res = super(qWebSandboxedEnvironment, self).is_safe_attribute(obj, attr, value)
if str(attr) in UNSAFE or not res:
raise SecurityError("access to attribute '%s' of '%s' object is unsafe." % (attr,obj))
return res
def safe_eval_qweb(expr, globals_dict=None, locals_dict=None, mode="eval", nocopy=False):