diff options
| author | niv-openerp <nicolas.vanhoren@openerp.com> | 2013-02-06 16:11:05 +0100 |
|---|---|---|
| committer | niv-openerp <nicolas.vanhoren@openerp.com> | 2013-02-06 16:11:05 +0100 |
| commit | 222802f00192e73d0e665d61a9142b0b4683aa48 (patch) | |
| tree | e8b8d6f4676d486af6f92120aac5f41ea4e60694 /addons/web_linkedin/web_linkedin.py | |
| parent | 33ae77e803d804a7c2bcce867b647a625dec0895 (diff) | |
[FIX] web_linkedin: possible problem with loading of images
lp bug: https://launchpad.net/bugs/1116226 fixed
bzr revid: nicolas.vanhoren@openerp.com-20130206151105-4xgxm350yje4vhtb
Diffstat (limited to 'addons/web_linkedin/web_linkedin.py')
| -rw-r--r-- | addons/web_linkedin/web_linkedin.py | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/addons/web_linkedin/web_linkedin.py b/addons/web_linkedin/web_linkedin.py index dc429cd2f29..277b4497ffc 100644 --- a/addons/web_linkedin/web_linkedin.py +++ b/addons/web_linkedin/web_linkedin.py @@ -29,7 +29,12 @@ class Binary(openerp.addons.web.http.Controller): _cp_path = "/web_linkedin/binary" @openerp.addons.web.http.jsonrequest - def url2binary(self, req,url): + def url2binary(self, req, url): + if not url.startswith("http"): + raise Exception("Not allowed to load a file using this protocol") + if url.count("?") > 0 or url.count("&") > 0 or url.count("=") > 0: + raise Exception("Not allowed to use GET parameters") + req.session.assert_valid(force=True) bfile = urllib2.urlopen(url) return base64.b64encode(bfile.read()) |