Daily updates from Odoo
Thursday, November 9, 2017
1 change
Security fixes and vulnerability patches
Odoo now blocks use of the default PostgreSQL administrator account even when it is supplied through environment settings. This closes a configuration loophole and makes database user handling more consistent during startup and database listing.
Original PR description
Description of the issue/feature this PR addresses: The db_user can be defined on on the command line of Odoo. If this user is 'postgres', Odoo exits with a warning. However, that verification can be bypassed when using the 'PGUSER' environment variable. Current behavior before PR: Setting the 'PGUSER' environment variable with 'postgres' bypasses the Odoo verification. Desired behavior after PR is merged: Odoo prevents the use of 'postgres' as a database user even when using the environment variable. -- I confirm I have signed the CLA and read the PR guidelines at www.odoo.com/submit-pr