diff options
| author | Christophe Simonis <chs@odoo.com> | 2017-04-24 11:07:55 +0200 |
|---|---|---|
| committer | Christophe Simonis <chs@odoo.com> | 2017-04-24 11:07:55 +0200 |
| commit | b5b8239870abb0c882f614ed57ebf8a04550cabe (patch) | |
| tree | 177c662f63139dec04a5f4ab050d810e7f3af0f8 /addons/web/controllers/main.py | |
| parent | a0ff1f2ad845a3d9359bdcb8f9861b18cbe40bf5 (diff) | |
| parent | 9e6860a22808a114a2f745e4bfd288e08460151b (diff) | |
[MERGE] forward port branch 9.0 up to 9e6860a2280
Diffstat (limited to 'addons/web/controllers/main.py')
| -rw-r--r-- | addons/web/controllers/main.py | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/addons/web/controllers/main.py b/addons/web/controllers/main.py index c209cdfdff9..1f97a1f3be8 100644 --- a/addons/web/controllers/main.py +++ b/addons/web/controllers/main.py @@ -52,6 +52,8 @@ env.filters["json"] = json.dumps # 1 week cache for asset bundles as advised by Google Page Speed BUNDLE_MAXAGE = 60 * 60 * 24 * 7 +DBNAME_PATTERN = '^[a-zA-Z0-9][a-zA-Z0-9_.-]+$' + #---------------------------------------------------------- # OpenERP Web helpers #---------------------------------------------------------- @@ -615,6 +617,7 @@ class Database(http.Controller): d['list_db'] = openerp.tools.config['list_db'] d['langs'] = openerp.service.db.exp_list_lang() d['countries'] = openerp.service.db.exp_list_countries() + d['pattern'] = DBNAME_PATTERN # databases list d['databases'] = [] try: @@ -636,6 +639,8 @@ class Database(http.Controller): @http.route('/web/database/create', type='http', auth="none", methods=['POST'], csrf=False) def create(self, master_pwd, name, lang, password, **post): try: + if not re.match(DBNAME_PATTERN, name): + raise Exception(_('Invalid database name. Only alphanumerical characters, underscore, hyphen and dot are allowed.')) # country code could be = "False" which is actually True in python country_code = post.get('country_code') or False request.session.proxy("db").create_database(master_pwd, name, bool(post.get('demo')), lang, password, post['login'], country_code) @@ -648,6 +653,8 @@ class Database(http.Controller): @http.route('/web/database/duplicate', type='http', auth="none", methods=['POST'], csrf=False) def duplicate(self, master_pwd, name, new_name): try: + if not re.match(DBNAME_PATTERN, new_name): + raise Exception(_('Invalid database name. Only alphanumerical characters, underscore, hyphen and dot are allowed.')) request.session.proxy("db").duplicate_database(master_pwd, name, new_name) return http.local_redirect('/web/database/manager') except Exception, e: |