[IMP] server,db: coherently handle PGUSER env variable
When Odoo is started with a db_user using 'postgres', the process exits with a status 1. However, this can be bypassed when the PGUSER environment variable is used. This commit will prevent the usage of the 'postgres' for the environment variable too. Also, when trying to list db's, various methods where used to find a suitable postgres user to get this list. In fact, as the db cursor is available, a user is already at work. So, in order to avoid code duplication (e.g. verify user from environment variables), this commit removes those various method and get the db user from the cursor.
This commit is contained in:
+1
-1
@@ -46,7 +46,7 @@ def check_postgres_user():
|
||||
This function assumes the configuration has been initialized.
|
||||
"""
|
||||
config = odoo.tools.config
|
||||
if config['db_user'] == 'postgres':
|
||||
if (config['db_user'] or os.environ.get('PGUSER')) == 'postgres':
|
||||
sys.stderr.write("Using the database user 'postgres' is a security risk, aborting.")
|
||||
sys.exit(1)
|
||||
|
||||
|
||||
+1
-8
@@ -361,14 +361,7 @@ def list_dbs(force=False):
|
||||
db = odoo.sql_db.db_connect('postgres')
|
||||
with closing(db.cursor()) as cr:
|
||||
try:
|
||||
db_user = odoo.tools.config["db_user"]
|
||||
if not db_user and os.name == 'posix':
|
||||
import pwd
|
||||
db_user = pwd.getpwuid(os.getuid())[0]
|
||||
if not db_user:
|
||||
cr.execute("select usename from pg_user where usesysid=(select datdba from pg_database where datname=%s)", (odoo.tools.config["db_name"],))
|
||||
res = cr.fetchone()
|
||||
db_user = res and str(res[0])
|
||||
db_user = cr._cnx.get_dsn_parameters().get('user')
|
||||
if db_user:
|
||||
cr.execute("select datname from pg_database where datdba=(select usesysid from pg_user where usename=%s) and not datistemplate and datallowconn and datname not in %s order by datname", (db_user, templates_list))
|
||||
else:
|
||||
|
||||
Reference in New Issue
Block a user