[FIX] tools: verify path before opening

1 files changed, 10 insertions, 1 deletions

diff --git a/odoo/tools/misc.py b/odoo/tools/misc.py
index 36061213003..c54af653a00 100644
--- a/odoo/tools/misc.py
+++ b/odoo/tools/misc.py
@@ -196,7 +196,16 @@ def file_open(name, mode="r", subdir='addons', pathinfo=False):
 
 
 def _fileopen(path, mode, basedir, pathinfo, basename=None):
-    name = os.path.normpath(os.path.join(basedir, path))
+    name = os.path.normpath(os.path.normcase(os.path.join(basedir, path)))
+
+    import odoo.modules as addons
+    paths = addons.module.ad_paths + [config['root_path']]
+    for addons_path in paths:
+        addons_path = os.path.normpath(os.path.normcase(addons_path)) + os.sep
+        if name.startswith(addons_path):
+            break
+    else:
+        raise ValueError("Unknown path: %s" % name)
 
     if basename is None:
         basename = name