diff options
| author | Olivier Dony <odo@openerp.com> | 2016-08-19 02:47:19 +0200 |
|---|---|---|
| committer | Olivier Dony <odo@openerp.com> | 2016-09-09 09:28:10 +0200 |
| commit | b17b2a2eb7c43017970a70bb4d7c8c6c239d6804 (patch) | |
| tree | 60f3133cc80451f18d3d7a848064730c8dc89d4f /addons/web/controllers/main.py | |
| parent | b2265108406e0dc1d1e1250fdbad5bc2cee2006d (diff) | |
[FIX] http: do not allow passing spaces around db in URL param
Until 9.0 our psycopg2 DSN connection strings do not allow having
spaces within the db name, and passing some can cause duplicate
registries to be loaded.
Stripping spaces is a simple workaround until we actually support
spaces within db names.
Fixes #13078
Diffstat (limited to 'addons/web/controllers/main.py')
| -rw-r--r-- | addons/web/controllers/main.py | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/addons/web/controllers/main.py b/addons/web/controllers/main.py index 3aa01cff047..1eacdbf0942 100644 --- a/addons/web/controllers/main.py +++ b/addons/web/controllers/main.py @@ -101,7 +101,7 @@ def ensure_db(redirect='/web/database/selector'): # If the db is taken out of a query parameter, it will be checked against # `http.db_filter()` in order to ensure it's legit and thus avoid db # forgering that could lead to xss attacks. - db = request.params.get('db') + db = request.params.get('db') and request.params.get('db').strip() # Ensure db is legit if db and db not in http.db_filter([db]): |