[IMP] config: allow blocking access to db manager

- The `--no-database-list` option will now also block access to database
  management functions and screens.
  Presumably this flag should only be used in production when all
  databases have been provisioned, so the admin should like to block
  access to the db manager at the same time.

- If no `--database` or `-d` parameter is provided, the system will be
  unable to fetch a list of databases at all, so users will be blocked
  with an error message.

- Hide the link on the login screen to the DB manager when it is
  disabled, to prevent sending users to an error page.

- Weak attempt at updating the documentation

Note: the security check for RPC methods could have been done in the RPC
dispatcher, however that would not have protected service methods when
called directly, e.g. by a controller (e.g. the dump method).

1 files changed, 3 insertions, 0 deletions

diff --git a/addons/web/controllers/main.py b/addons/web/controllers/main.py
index cc2ef4201df..17ca031a48f 100644
--- a/addons/web/controllers/main.py
+++ b/addons/web/controllers/main.py
@@ -491,6 +491,9 @@ class Home(http.Controller):
         if 'login' not in values and request.session.get('auth_login'):
             values['login'] = request.session.get('auth_login')
 
+        if not odoo.tools.config['list_db']:
+            values['disable_database_manager'] = True
+
         response = request.render('web.login', values)
         response.headers['X-Frame-Options'] = 'DENY'
         return response