diff options
Diffstat (limited to 'addons/web/controllers/main.py')
| -rw-r--r-- | addons/web/controllers/main.py | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/addons/web/controllers/main.py b/addons/web/controllers/main.py index cf6c8be5302..ed3e34762e5 100644 --- a/addons/web/controllers/main.py +++ b/addons/web/controllers/main.py @@ -651,6 +651,8 @@ class Database(http.Controller): @http.route('/web/database/create', type='http', auth="none", methods=['POST'], csrf=False) def create(self, master_pwd, name, lang, password, **post): try: + if not re.match('^[a-zA-Z][a-zA-Z0-9_]+$', name): + raise Exception(_('Invalid database name. Only alphanumerical characters and underscore are allowed.')) # country code could be = "False" which is actually True in python country_code = post.get('country_code') or False dispatch_rpc('db', 'create_database', [master_pwd, name, bool(post.get('demo')), lang, password, post['login'], country_code]) @@ -663,6 +665,8 @@ class Database(http.Controller): @http.route('/web/database/duplicate', type='http', auth="none", methods=['POST'], csrf=False) def duplicate(self, master_pwd, name, new_name): try: + if not re.match('^[a-zA-Z][a-zA-Z0-9_]+$', new_name): + raise Exception(_('Invalid database name. Only alphanumerical characters and underscore are allowed.')) dispatch_rpc('db', 'duplicate_database', [master_pwd, name, new_name]) return http.local_redirect('/web/database/manager') except Exception, e: |