[MERGE] forward port branch saas-11.2 up to 87dadc5bc83

4 files changed, 80 insertions, 2 deletions

diff --git a/doc/cla/corporate/vauxoo.md b/doc/cla/corporate/vauxoo.md
index 5bc8dca8882..512104ee2a6 100644
--- a/doc/cla/corporate/vauxoo.md
+++ b/doc/cla/corporate/vauxoo.md
@@ -1,4 +1,4 @@
-México, 9-2-2015
+México, 2015-02-09
 
 Vauxoo agrees to the terms of the Odoo Corporate Contributor License Agreement v1.0.
 
diff --git a/doc/cla/individual/gmarcon.md b/doc/cla/individual/gmarcon.md
new file mode 100644
index 00000000000..48cb3ea8c41
--- /dev/null
+++ b/doc/cla/individual/gmarcon.md
@@ -0,0 +1,11 @@
+Austria, 10/07/2018
+
+I hereby agree to the terms of the Odoo Individual Contributor License
+Agreement v1.0.
+
+I declare that I am authorized and able to make this agreement and sign this
+declaration.
+
+Signed,
+
+Giulio Marcon gmarcon@gmail.com https://github.com/gmarcon
\ No newline at end of file
diff --git a/doc/reference/translations.rst b/doc/reference/translations.rst
index adfc11a259f..81ec506df63 100644
--- a/doc/reference/translations.rst
+++ b/doc/reference/translations.rst
@@ -106,6 +106,7 @@ Blocks
 
     # bad, trailing spaces, blocks out of context
     _("You have ") + len(invoices) + _(" invoices waiting")
+    _t("You have ") + invoices.length + _t(" invoices waiting");
 
     # bad, multiple small translations
     _("Reference of the document that generated ") + \
@@ -115,6 +116,7 @@ Blocks
 
     # good, allow to change position of the number in the translation
     _("You have %s invoices wainting") % len(invoices)
+    _.str.sprintf(_t("You have %s invoices wainting"), invoices.length);
 
     # good, full sentence is understandable
     _("Reference of the document that generated " + \
diff --git a/doc/setup/deploy.rst b/doc/setup/deploy.rst
index dadd1484d46..c090f4cdbae 100644
--- a/doc/setup/deploy.rst
+++ b/doc/setup/deploy.rst
@@ -484,6 +484,14 @@ security-related topics:
   restricting access via a VPN, allowing only trusted IPs in the firewall, and/or
   running a brute-force detection system such as `fail2ban` or equivalent.
 
+- Consider installing appropriate rate-limiting on your proxy or firewall, to prevent
+  brute-force attacks and denial of service attacks. See also :ref:`login_brute_force`
+  for specific measures.
+
+  Many network providers provide automatic mitigation for Distributed Denial of
+  Service attacks (DDOS), but this is often an optional service, so you should consult
+  with them.
+
 - Whenever possible, host your public-facing demo/test/staging instances on different
   machines than the production ones. And apply the same security precautions as for
   production.
@@ -495,6 +503,50 @@ security-related topics:
   archiving server that is not accessible from the server itself.
 
 
+.. _login_brute_force:
+
+Blocking Brute Force Attacks
+----------------------------
+For internet-facing deployments, brute force attacks on user passwords are very common, and this
+threat should not be neglected for Odoo servers. Odoo emits a log entry whenever a login attempt
+is performed, and reports the result: success or failure, along with the target login and source IP.
+
+The log entries will have the following form.
+
+Failed login::
+
+      2018-07-05 14:56:31,506 24849 INFO db_name odoo.addons.base.res.res_users: Login failed for db:db_name login:admin from 127.0.0.1
+
+Successful login::
+
+      2018-07-05 14:56:31,506 24849 INFO db_name odoo.addons.base.res.res_users: Login successful for db:db_name login:admin from 127.0.0.1
+
+
+These logs can be easily analyzed by an intrusion prevention system such as `fail2ban`.
+
+For example, the following fail2ban filter definition should match a
+failed login::
+
+    [Definition]
+    failregex = ^ \d+ INFO \S+ \S+ Login failed for db:\S+ login:\S+ from <HOST>
+    ignoreregex =
+
+This could be used with a jail definition to block the attacking IP on HTTP(S).
+
+Here is what it could look like for blocking the IP for 15 minutes when
+10 failed login attempts are detected from the same IP within 1 minute::
+
+    [odoo-login]
+    enabled = true
+    port = http,https
+    bantime = 900  ; 15 min ban
+    maxretry = 10  ; if 10 attempts
+    findtime = 60  ; within 1 min  /!\ Should be adjusted with the TZ offset
+    logpath = /var/log/odoo.log  ;  set the actual odoo log path here
+
+
+
+
 .. _db_manager_security:
 
 Database Manager Security
@@ -507,7 +559,20 @@ dump or restore databases).
 
 If the management screens must not be accessible at all, you should set ``list_db``
 configuration option to ``False``, to block access to all the database selection and
-management screens. But be sure to setup an appropriate ``db_name`` parameter
+management screens.
+
+.. warning::
+
+  It is strongly recommended to disable the Database Manager for any internet-facing
+  system! It is meant as a development/demo tool, to make it easy to quickly create
+  and manage databases. It is not designed for use in production, and may even expose
+  dangerous features to attackers. It is also not designed to handle large databases,
+  and may trigger memory limits.
+
+  On production systems, database management operations should always be performed by
+  the system administrator, including provisioning of new databases and automated backups.
+
+Be sure to setup an appropriate ``db_name`` parameter
 (and optionally, ``db_filter`` too) so that the system can determine the target database
 for each request, otherwise users will be blocked as they won't be allowed to choose the
 database themselves.