From c0566b289608f2ebb97ece4683440a551c8db9b9 Mon Sep 17 00:00:00 2001
From: Olivier Dony <odo@openerp.com>
Date: Fri, 2 Sep 2016 13:56:33 +0200
Subject: [PATCH] [IMP] module: parse manifest files with literal_eval

Manifest files are literal Python dictionaries, and
aren't supposed to contain expressions that require
a full-fledged eval.
`literal_eval` is therefore sufficient *and* safer.

This parsing method was already used when listing addons
during startup of the Root controller (http.py, load_addons())
---
 odoo/modules/module.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/odoo/modules/module.py b/odoo/modules/module.py
index bd850870e4d..01a830843b4 100644
--- a/odoo/modules/module.py
+++ b/odoo/modules/module.py
@@ -1,6 +1,7 @@
 # -*- coding: utf-8 -*-
 # Part of Odoo. See LICENSE file for full copyright and licensing details.
 
+import ast
 import functools
 import imp
 import importlib
@@ -22,7 +23,6 @@ import odoo
 import odoo.tools as tools
 import odoo.release as release
 from odoo import SUPERUSER_ID, api
-from odoo.tools.safe_eval import safe_eval
 
 MANIFEST = '__openerp__.py'
 README = ['README.rst', 'README.md', 'README.txt']
@@ -316,7 +316,7 @@ def load_information_from_description_file(module, mod_path=None):
 
             f = tools.file_open(terp_file)
             try:
-                info.update(safe_eval(f.read()))
+                info.update(ast.literal_eval(f.read()))
             finally:
                 f.close()