odoo_source

Files

T

Jeremy Kersten fb8765b494 [FIX] base: ir.binary - return valid filename in Stream

Before this commit, if you have some special char like a return line \n,
or \r the get_stream_from method will crash with exception:

```
File "/home/odoo/src/odoo/odoo/addons/web/controllers/binary.py", line 163, in content_image
  return stream.get_response(**send_file_kwargs)
File "/home/odoo/src/odoo/odoo/odoo/http.py", line 578, in get_response
  res = _send_file(self.path, **send_file_kwargs)
File "/home/odoo/src/odoo/odoo/odoo/tools/_vendor/send_file.py", line 156, in send_file
  headers.set("Content-Disposition", value, **names)
File "/usr/local/lib/python3.9/dist-packages/werkzeug/datastructures.py", line 1218, in set
  self._validate_value(_value)
File "/usr/local/lib/python3.9/dist-packages/werkzeug/datastructures.py", line 1182, in _validate_value
  raise ValueError(

ValueError: Detected newline in header value.  This is a potential security problem
```

Now we replace `\n` `\r` by `_` before to serve the stream to avoid this
security exception from a safe way.
We decided to not use secure_filename from werzkeug because we want to
continue the support of non ascii char.

closes odoo/odoo#111851

X-original-commit: 95584e71a898017a92112f89e8a94315dd9235ac
Signed-off-by: Jérémy Kersten <jke@odoo.com>

2023-02-03 16:32:24 +01:00

controllers

[FIX] web: fix export m2m fields on using group_by

2023-01-17 16:47:24 +01:00

data

[IMP] core: use inert SQL based neutralization

2022-10-09 22:04:00 +02:00

i18n

[I18N] *: export saas-16.1 source terms

2023-01-24 10:20:30 +01:00

models

[IMP] core: make some cookies expire on logout