From 8a54670c57ccf012c8b4d041d0397626facb8e3b Mon Sep 17 00:00:00 2001 From: Christophe Lilo Matthieu Date: Fri, 11 Oct 2013 14:35:17 +0200 Subject: [PATCH] [FIX] qweb safe_eval: added safe attributes for evaluation. Currently _name is considered as safe; used in publish or edit management (object._name) bzr revid: tde@openerp.com-20131011123517-0xd0m7wfvq39s0y0 --- openerp/tools/safe_eval_qweb.py | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/openerp/tools/safe_eval_qweb.py b/openerp/tools/safe_eval_qweb.py index 08e81901376..a1ec46133be 100644 --- a/openerp/tools/safe_eval_qweb.py +++ b/openerp/tools/safe_eval_qweb.py @@ -82,13 +82,17 @@ BUILTINS = { 'relativedelta': lambda *a, **kw : relativedelta.relativedelta(*a, **kw), } UNSAFE = [str("browse"), str("search"), str("read"), str("unlink"), str("read_group")] +SAFE = [str("_name")] class qWebSandboxedEnvironment(SandboxedEnvironment): def is_safe_attribute(self, obj, attr, value): - res = super(qWebSandboxedEnvironment, self).is_safe_attribute(obj, attr, value) - if str(attr) in UNSAFE or not res: - raise SecurityError("access to attribute '%s' of '%s' object is unsafe." % (attr,obj)) + if str(attr) in SAFE: + res = True + else: + res = super(qWebSandboxedEnvironment, self).is_safe_attribute(obj, attr, value) + if str(attr) in UNSAFE or not res: + raise SecurityError("access to attribute '%s' of '%s' object is unsafe." % (attr,obj)) return res def safe_eval_qweb(expr, globals_dict=None, locals_dict=None, mode="eval", nocopy=False):