[FIX] auth_oauth: validate db against db_filter

addons/auth_oauth/controllers/main.py

@@ -133,6 +133,8 @@ class OAuthController(http.Controller):
     def signin(self, **kw):
         state = json.loads(kw['state'])
         dbname = state['d']
+        if not http.db_filter([dbname]):
+            return BadRequest()
         provider = state['p']
         context = state.get('c', {})
         registry = RegistryManager.get(dbname)
@@ -182,6 +184,8 @@ class OAuthController(http.Controller):
             dbname = db_monodb()
         if not dbname:
             return BadRequest()
+        if not http.db_filter([dbname]):
+            return BadRequest()
 
         registry = RegistryManager.get(dbname)
         with registry.cursor() as cr: