From dc798e317ef80fc56915e47eab81f4caf79625ad Mon Sep 17 00:00:00 2001
From: Raphael Collet <rco@openerp.com>
Date: Mon, 31 Aug 2015 10:08:06 +0200
Subject: [PATCH] [IMP] models: add a check on table and column names

In particular, this checks that table names are less than 64 bytes.
---
 openerp/fields.py     |  5 ++++-
 openerp/models.py     | 10 ++++++++++
 openerp/osv/fields.py |  1 +
 3 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/openerp/fields.py b/openerp/fields.py
index 2af01f354bf..0d93561af61 100644
--- a/openerp/fields.py
+++ b/openerp/fields.py
@@ -1887,6 +1887,9 @@ class Many2many(_RelationalMulti):
             column = self.to_column()
             if isinstance(column, fields.many2many):
                 self.relation, self.column1, self.column2 = column._sql_names(model)
+        elif self.store:
+            # check validity of table name
+            check_pg_name(self.relation)
 
     def _setup_regular_full(self, model):
         super(Many2many, self)._setup_regular_full(model)
@@ -1942,5 +1945,5 @@ class Id(Field):
 # imported here to avoid dependency cycle issues
 from openerp import SUPERUSER_ID, registry
 from .exceptions import Warning, AccessError, MissingError
-from .models import BaseModel, MAGIC_COLUMNS
+from .models import check_pg_name, BaseModel, MAGIC_COLUMNS
 from .osv import fields
diff --git a/openerp/models.py b/openerp/models.py
index eddef09cd31..2686397cea1 100644
--- a/openerp/models.py
+++ b/openerp/models.py
@@ -60,6 +60,7 @@ _unlink = logging.getLogger(__name__ + '.unlink')
 
 regex_order = re.compile('^(\s*([a-z0-9:_]+|"[a-z0-9:_]+")(\s+(desc|asc))?\s*(,|$))+(?<!,)$', re.I)
 regex_object_name = re.compile(r'^[a-z0-9_.]+$')
+regex_pg_name = re.compile(r'[a-z_][a-z0-9_$]*', re.I)
 onchange_v7 = re.compile(r"^(\w+)\((.*)\)$")
 
 AUTOINIT_RECALCULATE_STORED_FIELDS = 1000
@@ -92,6 +93,13 @@ def raise_on_invalid_object_name(name):
         msg = "The _name attribute %s is not valid." % name
         raise ValueError(msg)
 
+def check_pg_name(name):
+    """ Check whether the given name is a valid PostgreSQL identifier name. """
+    if not regex_pg_name.match(name):
+        raise ValueError("Invalid characters in table name %r" % name)
+    if len(name) > 63:
+        raise ValueError("Table name %r is too long" % name)
+
 POSTGRES_CONFDELTYPES = {
     'RESTRICT': 'r',
     'NO ACTION': 'a',
@@ -780,6 +788,8 @@ class BaseModel(object):
             # If _log_access is not specified, it is the same value as _auto.
             cls._log_access = cls._auto
 
+        check_pg_name(cls._table)
+
         # Transience
         if cls.is_transient():
             cls._transient_check_count = 0
diff --git a/openerp/osv/fields.py b/openerp/osv/fields.py
index 5d822901595..a0a48bb3991 100644
--- a/openerp/osv/fields.py
+++ b/openerp/osv/fields.py
@@ -935,6 +935,7 @@ class many2many(_column):
                                                'is not possible when source and destination models are '\
                                                'the same'
                 tbl = '%s_%s_rel' % tables
+                openerp.models.check_pg_name(tbl)
             if not col1:
                 col1 = '%s_id' % source_model._table
             if not col2: