[MERGE] forward port branch 10.0 up to 00e169c05a2

1 files changed, 4 insertions, 0 deletions

diff --git a/addons/web/controllers/main.py b/addons/web/controllers/main.py
index cf6c8be5302..ed3e34762e5 100644
--- a/addons/web/controllers/main.py
+++ b/addons/web/controllers/main.py
@@ -651,6 +651,8 @@ class Database(http.Controller):
     @http.route('/web/database/create', type='http', auth="none", methods=['POST'], csrf=False)
     def create(self, master_pwd, name, lang, password, **post):
         try:
+            if not re.match('^[a-zA-Z][a-zA-Z0-9_]+$', name):
+                raise Exception(_('Invalid database name. Only alphanumerical characters and underscore are allowed.'))
             # country code could be = "False" which is actually True in python
             country_code = post.get('country_code') or False
             dispatch_rpc('db', 'create_database', [master_pwd, name, bool(post.get('demo')), lang, password, post['login'], country_code])
@@ -663,6 +665,8 @@ class Database(http.Controller):
     @http.route('/web/database/duplicate', type='http', auth="none", methods=['POST'], csrf=False)
     def duplicate(self, master_pwd, name, new_name):
         try:
+            if not re.match('^[a-zA-Z][a-zA-Z0-9_]+$', new_name):
+                raise Exception(_('Invalid database name. Only alphanumerical characters and underscore are allowed.'))
             dispatch_rpc('db', 'duplicate_database', [master_pwd, name, new_name])
             return http.local_redirect('/web/database/manager')
         except Exception, e: