From b2a126da843ee3ded68d6c8b984990ae1c7b84c6 Mon Sep 17 00:00:00 2001 From: Christophe Monniez Date: Wed, 8 Nov 2017 15:55:51 +0100 Subject: [PATCH] [IMP] server,db: coherently handle PGUSER env variable When Odoo is started with a db_user using 'postgres', the process exits with a status 1. However, this can be bypassed when the PGUSER environment variable is used. This commit will prevent the usage of the 'postgres' for the environment variable too. Also, when trying to list db's, various methods where used to find a suitable postgres user to get this list. In fact, as the db cursor is available, a user is already at work. So, in order to avoid code duplication (e.g. verify user from environment variables), this commit removes those various method and get the db user from the cursor. --- odoo/cli/server.py | 2 +- odoo/service/db.py | 9 +-------- 2 files changed, 2 insertions(+), 9 deletions(-) diff --git a/odoo/cli/server.py b/odoo/cli/server.py index 7c6ccd30b54..87d09cce4b7 100644 --- a/odoo/cli/server.py +++ b/odoo/cli/server.py @@ -46,7 +46,7 @@ def check_postgres_user(): This function assumes the configuration has been initialized. """ config = odoo.tools.config - if config['db_user'] == 'postgres': + if (config['db_user'] or os.environ.get('PGUSER')) == 'postgres': sys.stderr.write("Using the database user 'postgres' is a security risk, aborting.") sys.exit(1) diff --git a/odoo/service/db.py b/odoo/service/db.py index 076820067df..8621144e35d 100644 --- a/odoo/service/db.py +++ b/odoo/service/db.py @@ -361,14 +361,7 @@ def list_dbs(force=False): db = odoo.sql_db.db_connect('postgres') with closing(db.cursor()) as cr: try: - db_user = odoo.tools.config["db_user"] - if not db_user and os.name == 'posix': - import pwd - db_user = pwd.getpwuid(os.getuid())[0] - if not db_user: - cr.execute("select usename from pg_user where usesysid=(select datdba from pg_database where datname=%s)", (odoo.tools.config["db_name"],)) - res = cr.fetchone() - db_user = res and str(res[0]) + db_user = cr._cnx.get_dsn_parameters().get('user') if db_user: cr.execute("select datname from pg_database where datdba=(select usesysid from pg_user where usename=%s) and not datistemplate and datallowconn and datname not in %s order by datname", (db_user, templates_list)) else: