[IMP] config: allow blocking access to db manager

- The `--no-database-list` option will now also block access to database
  management functions and screens.
  Presumably this flag should only be used in production when all
  databases have been provisioned, so the admin should like to block
  access to the db manager at the same time.

- If no `--database` or `-d` parameter is provided, the system will be
  unable to fetch a list of databases at all, so users will be blocked
  with an error message.

- Hide the link on the login screen to the DB manager when it is
  disabled, to prevent sending users to an error page.

- Weak attempt at updating the documentation

Note: the security check for RPC methods could have been done in the RPC
dispatcher, however that would not have protected service methods when
called directly, e.g. by a controller (e.g. the dump method).

1 files changed, 20 insertions, 9 deletions

diff --git a/doc/setup/deploy.rst b/doc/setup/deploy.rst
index 9879117b607..6e54815496a 100644
--- a/doc/setup/deploy.rst
+++ b/doc/setup/deploy.rst
@@ -71,7 +71,8 @@ in ``/etc/odoo.conf`` set:
   Once it is correctly working and only matching a single database per hostname, it
   is strongly recommended to block access to the database manager screens,
   and to use the ``--no-database-list`` startup paramater to prevent listing
-  your databases. See also security_.
+  your databases, and to block access to the database management screens.
+  See also security_.
 
 
 PostgreSQL
@@ -427,10 +428,14 @@ security-related topics:
 - Use appropriate database filters ( :option:`--db-filter <odoo-bin --db-filter>`)
   to restrict the visibility of your databases according to the hostname.
   See :ref:`db_filter`.
-
-- Once your ``db_filter`` is configured and only matches a single database per hostname,
-  you should set ``list_db`` configuration option to ``False``, to prevent listing databases
-  entirely (this is also exposed as the :option:`--no-database-list <odoo-bin --no-database-list>`
+  You may also use :option:`-d <odoo-bin -d>` to provide your own (comma-separated)
+  list of available databases to filter from, instead of letting the system fetch
+  them all from the database backend.
+
+- Once your ``db_name`` and ``db_filter`` are configured and only match a single database
+  per hostname, you should set ``list_db`` configuration option to ``False``, to prevent
+  listing databases entirely, and to block access to the database management screens
+  (this is also exposed as the :option:`--no-database-list <odoo-bin --no-database-list>`
   command-line option)
 
 - Make sure the PostgreSQL user (:option:`--db_user <odoo-bin --db_user>`) is *not* a super-user,
@@ -473,10 +478,16 @@ Database Manager Security
 This setting is used on all database management screens (to create, delete,
 dump or restore databases).
 
-If the management screens must not be accessible, or must only be accessible
-from a selected set of machines, use the proxy server's features to block
-access to all routes starting with ``/web/database`` except (maybe)
-``/web/database/selector`` which displays the database-selection screen.
+If the management screens must not be accessible at all, you should set ``list_db``
+configuration option to ``False``, to block access to all the database selection and
+management screens. But be sure to setup an appropriate ``db_name`` parameter
+(and optionally, ``db_filter`` too) so that the system can determine the target database
+for each request, otherwise users will be blocked as they won't be allowed to choose the
+database themselves.
+
+If the management screens must only be accessible from a selected set of machines,
+use the proxy server's features to block access to all routes starting with ``/web/database``
+except (maybe) ``/web/database/selector`` which displays the database-selection screen.
 
 If the database-management screen should be left accessible, the
 ``admin_passwd`` setting must be changed from its ``admin`` default: this